Hundreds of millions of iPhones and iPads are now vulnerable to a spyware tool that requires almost no technical skill to deploy.

The leaked “DarkSword” exploit kit, published to GitHub last week, targets devices running iOS 18 or earlier. According to Apple’s own data, roughly one-quarter of its 2.5 billion active devices fall into that category — potentially 600 million phones and tablets now open to attack by anyone who can copy and paste a few lines of code.

If your iPhone runs iOS 26, you’re fine. If you’ve enabled Lockdown Mode, you’re also protected. If neither applies, open Settings and update now. Apple released an emergency security patch on March 11 specifically for older devices that cannot run the latest operating system.

How It Works

DarkSword isn’t a technical masterpiece. It’s HTML and JavaScript — the same technologies that power basic websites. iVerify co-founder Matthias Frielingsdorf said the leaked code works “out of the box” with “no iOS expertise required,” an assessment Google’s researchers agreed with.

“You can copy and paste them and host them on a server in a couple minutes to hours,” said Frielingsdorf, who analyzed the leaked files. “They are way too easy to repurpose. I don’t think that can be contained anymore.”

Once installed, the spyware extracts contacts, messages, call history, and the iOS keychain, which stores Wi-Fi passwords and other sensitive credentials. Everything gets uploaded to a server controlled by the attacker. A security hobbyist using the handle matteyeux confirmed the exploit works against an iPad mini running iOS 18, posting proof on X.

From Government Tool to Public Weapon

DarkSword has a history. Researchers first identified it in a hacking campaign targeting Ukrainian users, allegedly linked to Russian government hackers. The code uploaded to GitHub appears to be a newer version, sharing infrastructure with earlier samples.

The leak follows a familiar pattern. Just weeks earlier, researchers discovered another iOS hacking toolkit called Coruna, developed by defense contractor L3Harris for U.S. government clients. Government-grade spyware keeps finding its way into public hands.

What makes DarkSword dangerous isn’t its sophistication — it’s its accessibility. When exploits require deep technical knowledge, the pool of potential attackers stays small. When they’re packaged as copy-paste JavaScript, that pool expands to anyone with a GitHub account and bad intentions. Google’s security researchers agreed with iVerify’s assessment that the tools are now trivially deployable.

What Users Should Do

Apple has already responded. The March 11 emergency update patches the vulnerability on devices stuck on older iOS versions. A spokesperson confirmed that updated software and Lockdown Mode both block the known attacks.

“Keeping your software up to date is the single most important thing you can do to maintain the security of your Apple products,” Apple spokesperson Sarah O’Rourke said.

The advice is straightforward: update your device. If you can’t update to iOS 26, apply the March 11 patch. If you’re a high-risk target — journalist, activist, executive — consider enabling Lockdown Mode, which restricts certain features to block sophisticated attacks.

The broader lesson is less comfortable. The market for iOS exploits is active, well-funded, and increasingly leaky. Tools built for governments don’t stay in government hands forever. When they spill into public code repositories, the consequences fall on ordinary users who just haven’t gotten around to that software update.

Sources