DarkSword: iPhone exploit chain used for espionage
A chain of six vulnerabilities affecting iOS 18.4 to 18.7 was used since at least November 2025 against users in Saudi Arabia, Turkey, Malaysia and Ukraine.
What happened
Google Threat Intelligence Group, together with Lookout and iVerify, describes a chain of six vulnerabilities affecting iOS 18.4 to 18.7. It has been used since at least November 2025 by commercial surveillance vendors and presumed state actors against users in Saudi Arabia, Turkey, Malaysia and Ukraine. It is fixed in iOS 26.3.
Why it matters
This is not a mass attack: it is surveillance aimed at specific people, with six flaws chained together to get into a phone without the user doing anything. For anyone in the crosshairs, the phone stops being a personal device and becomes someone else’s microphone: what is typed, what is said and where they are. That the chain has been running for months shows that whoever uses it needs neither publicity nor scale, only persistence. Nothing of this is visible to the user. That is why updating the system comes before any other measure for profiles that attract this kind of attention.
What we recommend
Update phones to iOS 26.3 or later. For the most exposed profiles, if updating is not possible, enable Lockdown Mode, which reduces the surface this type of chain needs. And do not assume a phone with no unusual apps is clean: here the attack does not depend on installing anything.
Related service: Digital Workplace · proteccion-alta-direccion
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.