Last week, security researchers uncovered an advanced hacking tool called “DarkSword” being used to target iPhone users. No, an updated version of the tool has been leaked on GitHub, sparking widespread concern.
Researchers warn that any hacker could easily use the tool to target iPhone and iPad users who have not updated to the latest iOS 26 systeem. According to Apple’s own data, the number of affected devices could reach into the hundreds of millions.
“This is bad. These tools are way too easy to repurpose,” said Matthias Frielingsdorf, co-founder of mobile security firm iVerify. “Criminals will start deploying it soon.”
He noted that the leaked files are just HTML and JavaScript, which anyone can deploy within minutes. Google’s security team agrees with this assessment. One security hobbyist said he had already used a sample circulating online to hack into an iPad running iOS 18.
Apple spokesperson Sarah O’Rourke said the company is aware of the vulnerability and issued an emergency patch on March 11 for devices unable to update to the latest system. “Keeping your software up to date is the most important thing you can do to stay secure,” she said, adding that updated devices and those with Lockdown Mode enabled are not affected.
The leaked code contains detailed comments describing how to steal sensitive information from target devices—including contacts, messages, call history, and Wi-Fi passwords—and send it to servers controlled by attackers. The code also references uploading data to a Ukrainian website, though the reason remains unclear.
According to analyses from multiple security firms, “DarkSword” specifically targets devices running iOS 18 and earlier versions. Apple data shows that about a quarter of users are still on these older systems, which—given there are more than 2.5 billion active devices—means hundreds of millions of users remain at risk.
Researchers recommend that all iPhone users update their operating systems as soon as possible to protect against potential attacks.