DarkSword is an exploit kit that infects an iPhone through an open web page in the browser and, within minutes, pulls messages, passwords, cookies and crypto wallet data off the phone. Lookout calls it a zero-click kit: nothing needs to be downloaded or confirmed, and opening the page is enough. That makes it dangerous even for a person who never follows unfamiliar links: the infected page can be an ordinary page on a legitimate site.
Google Threat Intelligence Group and Lookout described the kit on March 18, 2026, and since then the question has faced every iPhone owner who has not updated iOS. A phone holds exactly what the kit takes: messages, passwords, open email and banking sessions, and exchange and wallet apps. You can find out whether your phone is at risk from the iOS version in Settings.
How DarkSword infects an iPhone
The infection starts when a page opens in the browser. The user does not need to download a file, enter any data or confirm a prompt: the kit runs on a page the phone has simply loaded, and a chain of vulnerabilities takes it out of the browser and into the system.
The pages where this happens look normal. Lookout describes infected legitimate sites with a hidden iframe, with a court website and a news site among the examples, and the address stays genuine. Google describes a second variant as well, a lookalike site posing as Snapchat that victims were lured to. The script redirected Chrome users on iPhone to Safari, and Google concludes from this that the attackers have no exploit for Chrome.
The process is short. Lookout puts the kit's time on a device at minutes: the data is collected and sent out within seconds, after which the files it created are deleted. Google separately describes crash log cleanup, so little trace is left on the phone. Several groups have used the kit, and at the end of March 2026 its code ended up publicly available on GitHub, so now anyone who downloads it can own such a tool.
What DarkSword takes from the phone
Lookout and Google describe the kit the same way: it takes almost everything on the phone. Messages go out along with their history, including Telegram, WhatsApp and iMessage. Access credentials fare no better: the kit takes Safari history and cookies, saved passwords, the keychain and Wi-Fi passwords. Photos, notes, the calendar, iCloud Drive files, location history and the list of installed apps go too.
The reports single out crypto wallet data. Lookout lists exchange and wallet apps, among them Binance, Coinbase, MetaMask and Ledger.
The most valuable item on this list is the cookie. The browser stores cookies so it does not ask you to sign in again, and a session that has already passed the password and the second factor stays in the cookie. Whoever takes the cookie gets into the account without the password and without a new code. Recorded Future describes this as a bypass of multi-factor protection, because the code was entered once, at the start of the session. Two-factor authentication protects against password guessing and is powerless against theft of an already open session.
What the theft of phone data puts at risk
Open your phone and look at what is on it: email, messaging apps with your conversations, bank and service accounts left open in Safari, saved passwords, photos of documents, an exchange app or a wallet. All of this is on the list of what DarkSword takes.
What happens to an account after a session is stolen is shown by reports on other attacks. In July 2026, Mimecast described the theft of Meta Business Manager and Google Ads accounts and linked it to phishing and to the stealers DuckTail, NodeStealer, VietCredCare and PXA Stealer. After a takeover, the attackers add their own administrators, demote the owner to a limited role, raise spending limits and swap payment methods, and they run ads on the owner's funds. These attacks have nothing to do with DarkSword, but the mechanics are the same: a stolen session opens access to the owner's money.
The Google and Lookout reports describe what the kit takes from the phone, and they contain no cases of ad accounts being stolen through it. The cost of a mistake depends on what is open on the phone: the more access to money and to other people's accounts it holds, the higher that cost.
Which iOS versions are protected from DarkSword
iOS 26.3 and all later versions, including iOS 27, are closed to DarkSword: Google writes that all vulnerabilities in the chain were fixed in iOS 26.3, and Lookout calls that version safe for the 26 branch. The fixes arrived in stages, in iOS 18.6, 18.7.2, 18.7.3 and in the 26 line, and the last vulnerability in the chain was closed by iOS 26.3.
Within iOS 18, Lookout names build 18.7.3 and later as safe. The most reliable guide here is the latest build: as of November 2, 2026, that is iOS 18.7.11, released on October 26, 2026.
The iPhone XS, XS Max, XR and the seventh-generation iPad are stuck on iOS 18: iOS 26 cannot be installed on them, and Apple releases separate builds of the 18 branch for them. For iPhone 11 and later, the current version as of November 2, 2026 is iOS 27.2, and anyone staying on iOS 26 needs iOS 26.7.2. Both versions were released on October 26, 2026.
What to do to protect your iPhone
Protection rests on updates. A user's caution is not enough for it: Lookout writes that training people to recognize suspicious links is ineffective against this kind of attack, because the address of the infected site is legitimate and the user gets no signal at all.
First, check your iOS version against the threshold: you need iOS 26.3 or later, and on models that stayed on iOS 18, the latest build of that branch. Update any phone below the threshold today, before you open email, a bank or an exchange on it. This also applies to spare phones that sit in a drawer and are switched on now and then.
Turn on automatic updates. If you install fixes manually, do not put off the installation for longer than a week after release.
Separate the roles of your devices. The phone on which you read chats and open links from newsletters and messages should not be the same phone from which you confirm payments and work with an exchange. For money, a separate device with no shared chats and no casual browsing is the right fit.
If a phone holds large sums or access to other people's money, turn on Lockdown Mode: Apple writes that it protects against these attacks even on outdated versions of iOS. The mode restricts some browser features and message attachments, so everyone else can do without it.
Decide in advance in what order you will close sessions and change passwords if a phone falls under suspicion. Write the order down somewhere you can open it from another device.
If you are responsible for employees' phones, start with a list of devices: who has which phone, which iOS is on it and which work sessions are open on it. Set a minimum version and do not allow phones below it into work sessions. It is easier to fix the update deadline through MDM: Apple supports forced installation of updates on managed devices.
How to check that the phone is protected
The check takes a few minutes. Open Settings, General, Software Update and compare the installed version with the threshold: iOS 26.3 or later, and on iOS 18 the latest build. In a company, the same information appears in the fleet report from MDM.
Then go through the sessions. In Telegram they are in Settings, in the Devices section, and email, banks, exchanges and payment services each have their own list of active sign-ins. Close a session from a device you do not recognize, or from a phone on an old version, without debate.
What to change depends on where the weak link turns up. If the phone can run iOS 26.3 or later, an update settles the question in one evening. If it is an XS, XS Max or XR on the latest iOS 18 build, DarkSword is no longer a threat to it, but you should not keep money or important accounts on such a phone: fixes for these models arrive as separate builds ported from newer versions, and iOS 18 remains their last version. If the phone cannot be updated at all, stop opening email, a bank and an exchange on it, or replace it, and compare the price of replacement with the sums in the accounts it can reach.
What to do if your iPhone ran on a vulnerable version
Assume the worst. After stealing the data, the kit deletes the files it created and cleans the crash logs, so silence on the phone proves nothing, and the Google and Lookout reports offer no reliable way to check for infection on your own. If the phone ran iOS 18.4 or later without fixes and you opened websites on it, treat the sessions from it as stolen.
Do everything from a clean device, not from the phone under suspicion. First close the sessions, starting with those where money is involved: banks, exchanges, payment services, ad accounts, email and Telegram. Then change passwords and reissue the API keys and tokens that were stored on the phone or used from it.
If a seed phrase or private key was ever on the phone, in notes, photos or a wallet app, create a new wallet on a clean device and move the funds to it. On exchanges, revoke the API keys and check whether the withdrawal address whitelist is on: it restricts withdrawals to addresses approved in advance.
Only after that, update the phone and put it back to work, or replace it. Then review the history of sign-ins and operations for the period when the phone was vulnerable, and look for actions you did not take.
What will change in 2027
The events of 2026 show where the situation is heading. In March, Google described two exploit kits for iPhone, Coruna and DarkSword, and DarkSword's code appeared on GitHub at the end of the same month. On October 26, Apple released iOS 27.2, 26.7.2 and 18.7.11 and noted that one of the fixed vulnerabilities was linked to an extremely sophisticated attack on specific individuals on versions before iOS 27.
A clear plan follows from this. On October 26, fixes came out at the same time for three branches of iOS, so the one-week rule for installation works for any phone: look at the release date of the build for your model, not only for the latest iOS version. Phones stuck on iOS 18 should go into the replacement budget for 2027, while fixes for them are still coming out.
Mimecast describes the theft of ad accounts in July 2026 as a separate market, where stolen accounts are resold and used for advertising at the owner's expense. Session protection remains a task for all of 2027: the habit of closing unneeded sessions, confirming payments on a separate device, and signing out of accounts on shared phones.
Start with a single evening: check the iOS version on all of your phones, spare ones included, and close the sessions on those that fall short of iOS 26.3 or the latest iOS 18 build. Introduce a separate device for money and the one-week update rule next: they protect against any session theft, not only this kit.
