{"id":233607,"date":"2026-03-19T03:18:31","date_gmt":"2026-03-19T08:18:31","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/03\/new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones"},"modified":"2026-03-19T03:18:31","modified_gmt":"2026-03-19T08:18:31","slug":"new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/03\/new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones","title":{"rendered":"New \u201cDarksword\u201d iOS exploit used in infostealer attack on iPhones"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones.jpg\"><\/a><\/p>\n<p>A new exploit kit for iOS devices and delivery framework dubbed \u201cDarkSword\u201d has been used to steal a wide range of personal information, including data from cryptocurrency wallet apps.<\/p>\n<p>DarkSword targets iPhones running iOS 18.4 through 18.7 and is linked to multiple actors, including UNC6353, suspected to be Russian, who used the <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/spyware-grade-coruna-ios-exploit-kit-now-used-in-crypto-theft-attacks\/\" target=\"_blank\" rel=\"nofollow noopener\">Coruna exploit chain<\/a> disclosed earlier this month.<\/p>\n<p>Researchers at mobile security company <a href=\"http:\/\/www.lookout.com\/blog\/darksword\" target=\"_blank\" rel=\"nofollow noopener\">Lookout discovered DarkSword<\/a> while investigating the infrastructure used for the Coruna attacks. Google\u2019s Threat Intelligence Group and iVerify also collaborated for a more comprehensive analysis of this previously unknown threat and the adversaries leveraging it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A new exploit kit for iOS devices and delivery framework dubbed \u201cDarkSword\u201d has been used to steal a wide range of personal information, including data from cryptocurrency wallet apps. DarkSword targets iPhones running iOS 18.4 through 18.7 and is linked to multiple actors, including UNC6353, suspected to be Russian, who used the Coruna exploit chain [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1761,1512,1492],"tags":[],"class_list":["post-233607","post","type-post","status-publish","format-standard","hentry","category-cryptocurrencies","category-mobile-phones","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/233607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=233607"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/233607\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=233607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=233607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=233607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}