Leaked iPhone Exploit Kit Puts Millions At Risk

A powerful iPhone hacking toolkit has surfaced on a public code-sharing site, dramatically widening the risk to users running older versions of iOS. Security researchers say parts of a sophisticated exploit chain dubbed DarkSword are now freely available, lowering the barrier for copycat attacks. Combined with a related toolkit known as Coruna, the leak puts millions of iPhones and iPads squarely in the crosshairs.

These are not garden‑variety viruses. They are chains of browser and kernel exploits capable of compromising a device with little or no user interaction, then siphoning messages, photos, location history, browser data, authentication tokens, and even cryptocurrency wallets to attacker‑controlled servers.

What Leaked From The Toolkits And Why It Matters Now

Investigators who analyzed the toolkits say Coruna targets devices from iOS 13 up to iOS 17.2.1, while DarkSword includes exploit chains affecting newer builds, including iOS 18.4 and 18.7. The most immediate concern is the partial DarkSword code posted publicly, which makes it easier for less‑resourced actors to adapt the techniques for so‑called “drive‑by” attacks against people on outdated software.

Drive‑by or “watering hole” attacks can infect anyone who simply visits a compromised, otherwise legitimate website. That indiscriminate quality is what turns a targeted capability into a broad risk for everyday users, especially where patch adoption lags.

Who Is Being Targeted And Where Activity Is Seen

Security teams have observed activity linked to DarkSword in China, Malaysia, Turkey, Saudi Arabia, and Ukraine. Historically, large‑scale iOS exploitation has been rare, seen in high‑profile campaigns against Uyghurs and pro‑democracy communities in Hong Kong. The current leak threatens to expand that playbook beyond traditional espionage.

Kaspersky has tied two Coruna exploits to Operation Triangulation, a complex, likely state‑sponsored operation against Russian iPhone users. Google’s Threat Analysis Group is reviewing code attributed to DarkSword. Researchers say both state actors and financially motivated groups have used or adapted these tools.

How The Exploit Chains Operate Across iOS Versions

In broad terms, an attack begins with a remote code execution bug—often in the WebKit engine that powers Safari—followed by a sandbox escape and a kernel‑level privilege escalation. Once the chain lands, a lightweight implant can run in memory, harvest data, and communicate with a command server. Some variants need only a page view; no taps, downloads, or prompts are required.

Because these are modular chains, fragments of code leaked publicly can still be valuable to attackers, who mix and match components or pair them with known “n‑day” vulnerabilities to regain reliability after patches roll out.

The Scale Of Exposure For Outdated iPhones And iPads

Apple counts more than 2.5 billion active devices globally. Adoption data from the company indicates nearly 1 in 3 iPhones and iPads are not on the latest major release—translating to hundreds of millions of potentially exposed devices when powerful exploit kits are in circulation.

Enterprises are particularly vulnerable if a significant portion of their fleet lags behind required OS baselines. A single employee visiting a booby‑trapped site can provide an attacker foothold into corporate accounts and data.

What Security Teams Recommend Right Now To Reduce Risk

Update immediately. Independent analysts at iVerify advise upgrading to iOS 18.7.6 (or the latest available for your device) to block the vulnerabilities abused in these chains. Where applicable, update iPadOS to the newest release as well.

Enable Lockdown Mode if you think you could be a target for surveillance or high‑risk phishing. Apple says Lockdown Mode disrupts the exploit paths used in these campaigns, and researchers have documented cases where it thwarted spyware installation attempts.

Turn on automatic updates, restart your device after installing patches, and avoid installing unknown configuration profiles. Organizations should enforce minimum OS versions via MDM, audit mobile browser versions, and monitor for unusual outbound connections from managed iOS devices.

Why This Resembles 2017 All Over Again For Mobile Security

When elite tools escape controlled hands, they tend to spread. The 2017 leak of an NSA Windows exploit fueled the WannaCry ransomware that slammed networks worldwide. The DarkSword posting is a similar inflection point for mobile threats: a high‑end capability now at risk of commoditization.

Bottom Line For iPhone And iPad Users After The Leak

With parts of a potent iPhone exploit kit now public, the window for attackers has widened and the margin for users has narrowed. Patch now, consider Lockdown Mode if you face elevated risk, and keep an eye on credible security advisories from Apple and major research teams as this story evolves.