{"id":718500,"date":"2026-03-24T01:00:22","date_gmt":"2026-03-23T22:00:22","guid":{"rendered":"https:\/\/buradabiliyorum.com\/en\/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones\/"},"modified":"2026-03-24T01:00:22","modified_gmt":"2026-03-23T22:00:22","slug":"someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones\/","title":{"rendered":"Someone has publicly leaked an exploit kit that can hack millions of iPhones"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6ade967a3672d\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6ade967a3672d\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones\/#Contact_Us\" >Contact Us<\/a><\/li><\/ul><\/nav><\/div>\n<div>\n<p id=\"speakable-summary\" class=\"wp-block-paragraph\">Last week, cybersecurity researchers uncovered a hacking campaign targeting iPhone users that used an advanced hacking tool called DarkSword. Now someone has leaked a newer version of DarkSword and published it on the code-sharing site GitHub.<\/p>\n<p class=\"wp-block-paragraph\">Researchers are warning that this will allow any hacker to easily use the tools to target iPhone users running older versions of <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">App<\/a>le\u2019s operating systems who have not yet updated to its latest iOS 26 software. This likely affects hundreds of millions of actively used iPhones and iPads, according to Apple\u2019s own data on out-of-date devices.<\/p>\n<p class=\"wp-block-paragraph\">\u201cThis is bad. They are way too easy to repurpose,\u201d Matthias Frielingsdorf, the co-founder of mobile security startup iVerify, told TechCrunch on Monday. \u201cI don\u2019t think that can be contained anymore. So we need to expect criminals and others to start deploying this.\u201d<\/p>\n<p class=\"wp-block-paragraph\">Frielingsdorf said that these new versions of DarkSword spyware share the same infrastructure with the ones he and his iVerify colleagues <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/iverify.io\/blog\/darksword-ios-exploit-kit-explained\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">analyzed previously<\/a>, although the files are slightly different. The files uploaded to GitHub are uncomplicated, just HTML and JavaScript, he said, meaning anyone can copy and paste them and host them on a server \u201cin a couple minutes to hours.\u201d<\/p>\n<p class=\"wp-block-paragraph\">\u201cThe exploits will work out of the box,\u201d Frielingsdorf said. \u201cThere is no iOS expertise required.\u201d<\/p>\n<p class=\"wp-block-paragraph\">Kimberly Samra, a spokesperson for Google, which previously <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/darksword-ios-exploit-chain\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">analyzed the DarkSword exploit<\/a>, said the company\u2019s researchers agree with Frielingsdorf\u2019s assessment.\u00a0<\/p>\n<div class=\"article-block block--callout block--right has-green-500-background-color\">\n<h4 class=\"block--callout__title\"><span class=\"ez-toc-section\" id=\"Contact_Us\"><\/span>Contact Us<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>\t\t\tDo you have more information about Darksword, Coruna, or other government hacking and spyware tools? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or by email. \t\t<\/p><\/div>\n<p class=\"wp-block-paragraph\">A security hobbyist who goes by the handle matteyeux also told TechCrunch that it is indeed trivial to use the leaked DarkSword samples. Matteyeux <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/matteyeux\/status\/2035994616504226140\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">wrote<\/a> in a post on X Monday that he was able to hack an iPad mini tablet running iOS 18, the previous generation of the operating system that is vulnerable to DarkSword, using the \u201cin the wild\u201d DarkSword sample that is circulating online.\u00a0<\/p>\n<div class=\"wp-block-techcrunch-inline-cta\">\n<div class=\"inline-cta__wrapper\">\n<p>Techcrunch event<\/p>\n<div class=\"inline-cta__content\">\n<p>\n\t\t\t\t\t\t\t\t\t<span class=\"inline-cta__location\">San Francisco, CA<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"inline-cta__separator\">|<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"inline-cta__date\">October 13-15, 2026<\/span>\n\t\t\t\t\t\t\t<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<p class=\"wp-block-paragraph\">Apple spokesperson Sarah O\u2019Rourke told TechCrunch that the company was aware of the exploit targeting devices running older and out-of-date operating systems and issued an emergency update on March 11 for devices unable to run recent versions of iOS.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">\u201cKeeping your software up to date is the single most important thing you can do to maintain the security of your Apple products,\u201d O\u2019Rourke said, adding that devices with updated software were not at risk from these reported attacks and that Lockdown Mode would also block these specific attacks.<\/p>\n<p class=\"wp-block-paragraph\">A spokesperson for Microsoft, which owns GitHub, did not im<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">media<\/a>tely respond to a request for comment.<\/p>\n<p class=\"wp-block-paragraph\">The code, which TechCrunch is not linking to, as it can be used in active attacks, contains several comments that describe how the exploits work and how to implement them.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">One comment, likely written by one of the developers who worked on DarkSword, says that the exploit \u201creads and exfiltrates forensically-relevant files from iOS devices via HTTP,\u201d referring to stealing information from a person\u2019s iPhone or iPad and sending the data over the internet to an attacker-controlled server.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">\u201cThis payload should be injected into a process with filesystem access class,\u201d the comment reads.<\/p>\n<p class=\"wp-block-paragraph\">In one case, the code references \u201cpost-exploitation activity\u201d and describes process after the malware has gained access to the person\u2019s phone and grabs its contents, including their contacts, messages, call history, and iOS keychain, which stores Wi-Fi passwords and other secrets, and dumps them into a remote server.<\/p>\n<p class=\"wp-block-paragraph\">Another file contains references to uploading data to a popular Ukrainian apparel website, though TechCrunch could not immediately determine why. DarkSword was allegedly used by Russian government hackers against Ukrainian targets.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">This particular spyware works specifically against iPhones and iPads running iOS 18, according to iVerify, <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/darksword-ios-exploit-chain\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Google<\/a>, and <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.lookout.com\/blog\/darksword\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Lookout<\/a>, which also previously analyzed the DarkSword malware.<\/p>\n<p class=\"wp-block-paragraph\"><a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/developer.apple.com\/support\/app-store\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">According to Apple\u2019s own numbers<\/a>, about one-quarter of all iPhone and iPad users are still running iOS 18 or earlier on their device. With <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.apple.com\/newsroom\/2026\/01\/apple-reports-first-quarter-results\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">more than 2.5 billion<\/a> active devices, that likely equates to hundreds of millions of people whose devices are vulnerable to DarkSword attacks.\u00a0\u00a0<\/p>\n<p class=\"wp-block-paragraph\">That\u2019s why Frielingsdorf recommends everyone upgrade their iPhone\u2019s operating system.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">The discovery of DarkSword came only a few weeks after researchers discovered another advanced iPhone hacking toolkit known as Coruna. As TechCrunch reported, Coruna was originally developed by the defense contractor L3Harris, whose Trenchant division makes hacking tools for the U.S. government and its allies.<\/p>\n<\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMN63nwsw68G3Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" target=\"_blank\" >Technology<\/a><\/span> category.<\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/techcrunch.com\/2026\/03\/23\/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones\/\" target=\"_blank\" >Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last week, cybersecurity researchers uncovered a hacking campaign targeting iPhone users that used an advanced hacking tool called DarkSword. Now someone has leaked a newer version of DarkSword and published it on the code-sharing site GitHub. Researchers are warning that this will allow any hacker to easily use the tools to target iPhone users running&#8230;<\/p>\n","protected":false},"author":1,"featured_media":718501,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/02\/iphone-jailbreak.jpg?resize=1200,800","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[76978,5029,70375,161306,61594,72516,70944,70513,5030,161307,72287],"class_list":["post-718500","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-cybercrime","tag-apple","tag-cybersecurity","tag-darksword","tag-exclusive","tag-github","tag-hackers","tag-hacking","tag-iphone","tag-iverify","tag-security"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/718500","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=718500"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/718500\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/718501"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=718500"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=718500"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=718500"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}