Researchios exploitmobile securitywatering holelookout
Russia-Linked Actor Deploys DarkSword iPhone Malware
8.2
Researchers at Lookout said on Wednesday that a likely Russia-linked threat actor has deployed DarkSword, a sophisticated iPhone malware, to target Ukrainian users since late 2025 through March 2026 via watering-hole websites. The tool rapidly exfiltrates emails, messages, photos, credentials and cryptocurrency wallet data within minutes and then erases traces; Apple patched the exploited vulnerabilities in late 2025.
Key Points
- 1DarkSword malware compromises iPhones via watering-hole exploits, exfiltrating emails, messages, photos, credentials, and crypto-wallet data.
- 2Researchers at Lookout link campaign to UNC6353, suggesting access to high-end exploits or commercial surveillance tools.
- 3Practitioners should prioritize patching, monitor watering-hole compromises, and protect keys for Coinbase, Binance, Kraken, MetaMask.
Scoring Rationale
Strong vendor-backed discovery with actionable mitigation, but geographically focused targeting and moderate technical disclosure limit universal applicability.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
