A newly discovered iPhone spyware called Darksword could target millions of devices, according to security researchers. The malware has already been found active on multiple websites linked to Ukraine.
Researchers say the attack targets older iOS versions. Devices running iOS 18.4 to 18.6.2 are most vulnerable. These versions were released in 2025 and are still widely used.
Security firms Lookout and iVerify found that the spyware can steal personal data and cryptocurrency wallet details. The attack works when users visit infected websites. Once triggered, it can access sensitive information without clear signs.
Experts estimate that between 220 million and 270 million iPhones may still be exposed. Apple has already patched the vulnerabilities in newer updates. However, many users have not installed the latest iOS versions.
This is the second major iPhone spyware discovery this month. Earlier, researchers identified another tool called Coruna. Both tools were linked to similar infrastructure, pointing to a growing spyware market.
This signals a shift in mobile security risks. iPhone attacks were once rare and mostly linked to state level actors. Researchers now warn that such tools are spreading to financially motivated groups.
Investigators also found signs of weak operational security from attackers. This suggests the spyware is being used at scale. That increases the risk of broader attacks.
Apple has not commented on the findings so far. Users are strongly advised to update their iPhones to the latest iOS version to stay protected.
