Apple has issued an urgent alert urging millions of iPhone users to update their devices immediately after cybersecurity experts uncovered a potent spyware strain capable of hijacking phones running outdated iOS versions.
Massive Spyware Threat Targets Older iPhones
Cybersecurity researchers at Lookout, iVerify, and Google have identified Darksword, a sophisticated malware that can covertly extract sensitive data from hundreds of millions of iPhones still operating on iOS versions released between March and August 2025—specifically versions 18.4 to 18.6.2.
Experts estimate that a staggering 220 to 270 million devices remain vulnerable, running these legacy iOS versions and susceptible to stealthy data breaches.
Targets and Impact
Analysis reveals that Darksword has primarily targeted specific groups: Ukrainians under Russian intelligence surveillance, Chinese cryptocurrency users, and individuals in Saudi Arabia, Turkey, and Malaysia. This spyware can exfiltrate emails, usernames, passwords, private photos, and cryptocurrency wallets—posing an unprecedented threat to personal and financial security.
The discovery links Darksword to servers also used by suspected Russian operators deploying another potent iPhone spyware tool called Coruna, previously disclosed on March 3 by Google and iVerify. Coruna has connections to Russian intelligence agencies and Chinese cybercriminal networks.
Rising Threat of Advanced Mobile Malware
Lookout describes Darksword as an “exceptionally sophisticated” and “professionally engineered” platform, underscoring the escalating market for advanced malware targeting mobile devices.
Apple spokesperson Sarah O’Rourke emphasized that both Darksword and Coruna only affect devices on older iOS versions, reinforcing the critical need for users to install updates promptly. “Keeping software up to date remains the single most important step users can take to ensure the robust security of their Apple devices,” she stated.
Expert Warnings
John Scott-Railton, senior researcher at Citizen Lab—a University of Toronto cybersecurity research center—warns that the ease of deploying devastating mobile attacks has significantly increased. He told NBC News, “The barrier to entry for widespread, devastating mobile attacks has been decisively lowered… this threat will only intensify.”
Scott-Railton added, “The most alarming aspect for everyday users is that these attacks are virtually undetectable.”
Apple’s Swift Response
Apple released the latest iOS 26 update in September, which protects users from both Darksword and Coruna spyware campaigns. In a rare move, Apple also issued a special security patch last week for older iPhone models unable to upgrade fully to iOS 26, specifically designed to block these hacking tools and protect vulnerable users.
This proactive effort highlights Apple’s commitment to safeguarding its ecosystem amid a growing wave of sophisticated cyber threats targeting mobile platforms worldwide.
