The recent discovery of two advanced iPhone exploit kits, DarkSword and Coruna, points to a concerning shift in how attacks are being deployed. Unlike earlier spyware that focused on high-profile individuals, these exploits are spreading through compromised, legitimate websites. That means simply visiting the wrong site could put your device at risk, with no clicks or downloads required. It’s a strong signal that exploit tools are now being sold more widely, including to financially motivated hacking groups.
To make matters worse, the full DarkSword exploit code has been published on GitHub. Security researchers say it can work “out of the box,” meaning it doesn’t take deep iOS knowledge to use. Someone could copy the code, set it up, and have it running in just a few hours.
Once active, DarkSword can gain elevated system access and quietly collect a wide range of sensitive data. This includes passwords stored in the keychain, photos, call logs, contacts, browsing history, and message history. It’s designed for speed, grabbing as much data as possible before disappearing. Coruna takes a different approach, focusing more on persistence and targeting financial data, including cryptocurrency wallets and notes that may contain sensitive information.
Protection Is Simple
The good news is that protecting yourself is straightforward: keep your devices up to date. It’s something we’ve emphasized for years, and in this case, it’s especially important. Apple has even published dedicated guidance stating that keeping your software current is the single most effective way to protect your devices.
If your iPhone is running the latest version of iOS it supports, you’re already protected. If you’ve delayed updates or stayed on an earlier version, your device could still be vulnerable. Apple has also released iOS 18.7.7 for users who aren’t ready to move to iOS 26, so you can stay secure without adopting the newest interface changes.
Check and Update Your Device
To check your current iOS version, go to Settings > General > About and look for the iOS Version.
- DarkSword affects devices running iOS 18.4 through 18.7.2
- You’re protected on iOS 18.7.3 or later, or iOS 26.3 or later
- Coruna affects older devices running iOS 13.0 through 17.2.1
Apple has released updates for older devices as well:
- iOS 15.8.7 and iOS 16.7.15 address these issues for devices that can’t run newer versions
- Devices on iOS 13 or 14 should update to iOS 15.8.7
- Devices on iOS 17 should update to the latest supported version
To update your device, go to Settings > General > Software Update.
- iPhone 11 and newer: update to iOS 18.7.7 or iOS 26.4 or later
- iPhone XR, XS, XS Max: update to iOS 18.7.7
- Older devices (iPhone 6s through iPhone X and similar iPads): update to iOS 15.8.7 or 16.7.15
If you’re unable to update, Apple recommends enabling Lockdown Mode (Settings > Privacy & Security > Lockdown Mode). It can block these types of attacks, but it also limits certain features, so for most people, updating is the better path.
These developments are a clear reminder that staying current on updates matters more than ever. Threats that were once highly targeted are now being used more broadly. Take a moment to check your devices, install any available updates, and encourage others to do the same.
(Featured image by iStock.com/sqback)
