Double-edged threat. [Research Saturday]
Brief
Today we are joined by Justin Albrecht , Principal Researcher at Lookout , discussing "Attackers Wielding DarkSword Threaten iOS Users." DarkSword is a highly sophisticated iOS exploit chain discovered by Lookout that targets iPhones (iOS 18. 4–18.
- 2), enabling near zero-click compromise and rapid theft of sensitive data, including credentials and cryptocurrency wallet information.
Likely deployed by a Russia-linked threat actor (UNC6353) against Ukrainian users, it uses watering hole attacks on compromised websites and operates in a “hit-and-run” fashion—exfiltrating data within minutes before wiping traces.
The campaign highlights a growing secondary market for advanced exploits, allowing financially motivated groups to access powerful tools once reserved for state actors, significantly expanding the mobile threat landscape.