Discussion
Hundreds of Millions of iPhones Can Be Hacked With a New Tool Found in the Wild
BTAQA: The interesting angle here is what this means for passes and credentials stored in Apple Wallet. If device compromise is this accessible, the assumption that Wallet passes are isolated from the rest of the device needs more scrutiny. Apple's security model relies heavily on the secure enclave but a tool like this changes the threat surface significantly.
jryio: Here is the Google Research group's writeuphttps://cloud.google.com/blog/topics/threat-intelligence/dar...Relevant forward:> GTIG has identified several different users of the DarkSword exploit chain dating back to November 2025. In addition to the case studies on DarkSword usage documented in this blog post, we assess it is likely that other commercial surveillance vendors or threat actors may also be using DarkSword.> Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword. Since at least November 2025, GTIG has observed multiple commercial surveillance vendors and suspected state-sponsored actors utilizing DarkSword in distinct campaigns. These threat actors have deployed the exploit chain against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.> DarkSword supports iOS versions 18.4 through 18.7 and utilizes six different vulnerabilities to deploy final-stage payloads. GTIG has identified three distinct malware families deployed following a successful DarkSword compromise: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. The proliferation of this single exploit chain across disparate threat actors mirrors the previously discovered Coruna iOS exploit kit. Notably, UNC6353, a suspected Russian espionage group previously observed using Coruna, has recently incorporated DarkSword into their watering hole campaigns.
joezydeco: I got an alert this morning for an iOS update numbered 26.3.1(a).(a)? This must be really bad.
dewey: > It can take over devices running iOS 18 that simply visit infected websites.I wonder if this is supposed to be > iOS 18 or really just version 18?
ramesh31: Welp, I've been holding on out that liquid glass crap as long possible. Guess my phone is just going to suck now.
quentindanjou: It's in the source article (from Google Research group):> DarkSword supports iOS versions 18.4 through 18.7https://cloud.google.com/blog/topics/threat-intelligence/dar...The source exploits continued to be patched with all of them patched in iOS 26.3
dewey: Oh, I was confused why the article was so short and chalked it up to it being some developing story. Turns out there's a "You’ve read your last free article." heading that hides the rest but it's not very obvious that there's an article hiding.
alecco: This should be the post, not Wired's blogspam.
msk-lywenn: [delayed]
k2enemy: I'm really hoping Apple backtracks on its refusal to update the 18.x line for phones that are compatible with 26. At least provide a security update.
bombcar: If it's really as bad as all that, they'll patch existing older releases.
pfortuny: One can hope but I do not trust them.
pfortuny: Not going to happen (despite my still being on 18.x) because they want to force you to upgrade to 26 for publicity. As simple as that.The new "security upgrade available" will (I bet) be "to 26".
MrDOS: I wish I had a better sense of how these zero-click vulnerabilities work so I could get a sense of how to protect myself from them (you know, without giving in to Liquid Glass). Can they be blocked by an ad blocker? Are they blocked by any extant ad blockers? What about “Lockdown Mode”?
lynndotpy: Apple used to have a really good security record, it's mind boggling they blew it all up just to force Liquid Glass on users.For those not in the loop, Apple used to provide security patches for supported older iOS versions. They changed a lot of behavior around the release of Liquid Glass (iOS 26, MacOS Tahoe). Starting with iOS 18.7.3, they only release patch versions for the iPhone XS and XR. They've repeated this, through to 18.7.6 now.So much goodwill and trust, obliterated.
hnburnsy: >We also identified additional code added when the actor attempts to infect a user using Chrome, where the x-safari-https protocol handler is used to open the page in Safari (Figure 4). This suggests that UNC6748 didn't have an exploit chain for Chrome at the time of this activity.Thanks Apple for allowing the overriding of the user's default browser.
bix6: I know everyone hates liquid glass but isn’t that better security wise than being on an iOS that’s 8 versions behind?
jryio: There are not 8 major versions between iOS 18 and iOS 26. Apple skipped the monotonously increasing version numbering system since iOS 1 during WDDC 2025 to adopt a year suffix based versioning system.iOS 17, then iOS 18, then iOS 26, then iOS 27.You're not the only party confused.
bix6: Haha thanks! Good to know they are on years now. Back to random version numbers in 5 year? :p
neom: I thought the same thing but updated couple weeks back and actually really really enjoy the liquid glass. I don't recall what it was about the release that made me think I'd hate it, but I've half fallen in love with it, I was just thinking yesterday I wonder what all the fuss was about.
thejazzman: I believe it's changed a lot since it was initially debut'd via the betas. And there was that Supabase post mocking it, where they made the whole UI glass, and that biased me a bit ha
bombcar: What device? I don't see anything beyond 26.3.1 on my iPhone 15 PromaxXDR™
joezydeco: iPhone 15 (vanilla) running iOS 18.7.2. I now have a permanent notification on my lock screen nagging me to update to iOS 26.
qaz_plm: Enabling beta updates for ios18 should kill the nagging notification.
joezydeco: I'm keeping it there to remind me to stay defiant against the shittier UI. I'll wait until they can put it on a user switch or create a more readable option for older users. Which will probably be 'never'.
fn-mote: Note that this is 1-click.0-click example: receive an MMS with a malformed image that exploits a bug in decoding
yborg: It's especially glaring since Apple just released a fix for a Coruna exploit that patched iOS 15.
SimianSci: It's a watering hole attack. At any point your iphone sends an http request to a compromised site, by add, link, embedded, etc. your device will be exploited. there really isn't a way to permanently defeat this. We are about to see an explosion of novel attack types utilizing this exploit as their basis, you realistically cannot defend yourself against these without either updating or no longer using an iphone.
titzer: Those trillions of dollars aren't going to find their way into the pockets of the shareholders if they have to pay some rubes to maintain old stuff!
6510: I'm always surprised what isn't a national security issue.
