If you have an old iPhone or are using an older version of iOS, you should be careful. Many companies like Google and Lookout have detected a new cyber attack, which has been named “DarkSword”. This attack specifically targets users who have older iPhones or are using older versions of iOS (from iOS 18.4 to iOS 18.7). Researchers say this threat has been active since November 2025 and is being used by scammers who work in collaboration with both commercial vendors and government entities.
Users from these countries are at greater risk
Through this campaign, users from countries like Saudi Arabia, Türkiye, Malaysia and Ukraine are being specifically targeted. Attackers are exploiting various vulnerabilities to gain unauthorized access to targeted devices. Harmful websites are being used to insert malware into users’ phones. Once installed on the device, this malware collects all the necessary information and then erases all traces of its existence in a very short period of time. Researchers have named this strategy of data theft as “hit-and-run” operation.
Russian group suspected to be behind the hack
Security firm Lookout claims that Russian hacking group UNC6353 is behind this campaign. This group has a long history of breaking into iOS systems. This group’s “Coruna” tool had earlier also targeted iPhones with versions ranging from iOS 13 to iOS 17. According to the report, in previous attacks the malware was spread through a fake website that was made to look like Snapchat. Users mistook the site for the real Snapchat platform and clicked on it; With just one click, the malware gets installed on the device and immediately starts its harmful work.