DarkSword: Researchers uncover another iOS exploit kit
2026-03-19T14:51:47Z•9e45fb659936a863f9976f3a46434550fb8abb6eb7b9bd82d5f665466394122f
CorunaDarkSwordGoogle Threat Intelligencecybercrimeexploit kitiOSiVerifymobile securityspywarestate-linked actorssurveillancezero-day
What happened
DarkSword is a commercial iPhone exploit kit, active since November 2025, that leverages zero‑day iOS vulnerabilities to compromise devices and deploy spyware. Google Threat Intelligence researchers (with iVerify) disclosed the toolkit; operators include state‑linked threat actors and cybercriminals. DarkSword is discussed alongside the recently disclosed Coruna iOS exploit set, indicating continued, multi‑vector exploitation of Apple devices in surveillance campaigns.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- helpnetsecurity
- Record identifier
- 9e45fb659936a863f9976f3a46434550fb8abb6eb7b9bd82d5f665466394122f
- Enrichment time
- 2026-03-19T14:51:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.