'Darksword' spyware leaves millions of iPhones vulnerable, researchers warn

MICHIGAN: A potent software exploit with the ability to infiltrate and extract data from potentially hundreds of millions of Apple iPhones was embedded on dozens of Ukrainian websites in recent weeks, cybersecurity researchers revealed on Wednesday.

The finding represents the second instance this month in which researchers have identified spyware targeting iPhones and other Apple devices. Taken together, the two hacking tools indicate that the market for advanced malware designed to steal data and cryptocurrency wallet information is thriving, according to the researchers.

Coordinated disclosure by major cyber firms

Researchers from cybersecurity firm Lookout, mobile security company iVerify, and Alphabet's Google released coordinated analyses of the malware, which they have named "Darksword." The discovery came after Google and iVerify had already disclosed a separate powerful iPhone spyware dubbed "Coruna" on March 3. Researchers subsequently found Darksword hosted on the same servers as Coruna.

Financial motives suspected

The findings suggest that sophisticated exploits are increasingly ending up in the possession of actors driven by financial gain rather than purely state-sponsored espionage.

"There's now a verified pipeline of recent exploits that have ended up in the hands of potentially criminal entities with a financial focus," said Justin, a researcher involved in the analysis.

The Darksword spyware was planted across dozens of websites based in Ukraine, raising concerns about the scale of the operation and the number of users who may have been exposed. With the malware capable of penetrating potentially hundreds of millions of iPhones, the threat is considered significant by cybersecurity experts who participated in the coordinated disclosure.

The emergence of two distinct spyware tools — Darksword and Coruna — targeting Apple's ecosystem within the same month underscores the growing sophistication of threats facing iPhone users globally. Both tools were found to be hosted on shared server infrastructure, pointing to possible links between the operations or shared resources among the threat actors behind them.

The coordinated publication of findings by Lookout, iVerify, and Google highlights the collaborative approach that major technology and security firms are increasingly adopting to combat advanced cyber threats. The involvement of Alphabet's Google, in particular, signals the seriousness with which major tech companies are treating the proliferation of spyware capable of compromising widely used consumer devices.

The discovery is likely to intensify scrutiny of the commercial spyware industry and the channels through which powerful exploits reach criminal actors with financial motivations, as researchers have warned.