A new cyberweapon is testing the limits of Apple’s vaunted security. Researchers from Google and cybersecurity firms iVerify and Lookout have uncovered “DarkSword”, a sophisticated spyware framework capable of infiltrating millions of iPhones and extracting highly sensitive data.
Unlike traditional malware, DarkSword operates as a modular toolkit used by both commercial spyware vendors and state-backed actors. It exploits multiple vulnerabilities”some of them previously unknown “zero-days””allowing attackers to bypass Apple’s tightly controlled ecosystem. The result is a near-complete device compromise: messages, emails, location data, browser histories, and even encrypted credentials can be siphoned off with little user awareness.
More troubling is its method. DarkSword often employs “fileless” techniques, hijacking legitimate system processes rather than installing persistent malware. This makes detection difficult and enables rapid, “smash-and-grab” data extraction within minutes of infection.
The tool has reportedly been deployed in targeted campaigns across regions, including Eastern Europe, the Middle East, and Southeast Asia, underscoring the growing overlap between commercial surveillance markets and geopolitical cyber operations.
Apple has since patched the exploited vulnerabilities, urging users to update their devices. Yet the episode highlights a broader shift: once rare, high-end iPhone exploits are becoming scalable and reusable. In the emerging cyber-arms market, even the most secure consumer devices are no longer beyond reach.
