In summary:
- Apple reportedly urges iPhone users to update immediately after the DarkSword hacking toolkit became freely available on GitHub, targeting vulnerable devices.
- According to Macworld, iPhones running iOS 18.4 to 18.7 are at risk from this JavaScript-based malware that steals personal data through families like Ghostblade and Ghostknife.
- Users can protect themselves by updating to iOS 26.3 or later via Settings > General > Software Update, as timely updates remain the most crucial security step.
The latest iOS security report is a good reminder that iPhone users need to install iOS updates as soon as possible. TechCrunch (a sister publication to Macworld) reports that an updated version of the DarkSword hacking toolkit has been released on GitHub, which means the softare is freely available for download on the internet by threat agents.
Last week, the Google Threat Intelligence Group (GTIG) reported on DarkSword, software used to create three malware families called Ghostblade, Ghostknife, and Ghostsaber. The malware uses JavaScript, and attackers embeds the code in a website. When the user visits the website, the JavaScript executes and installs malware on the iPhone that can gather the user’s personal data, record audio, or check GS data for the current location. The information is then uploaded to a remote server. GTIG said that most targeted users in Malaysia, Saudi Arabia, Turkey, and Ukraine.
iPhones running iOS 18.4 to 18.7 are vulnerable to the attacks, but all of the security holes used by the DarkSword malware have been fixed as of iOS 26.3 (the current version is iOS 26.3.1); most of them were fixed before 26.3. The latest version of iOS 18 is 18.7.6, released on March 4.
“Keeping your software up to date is the single most important thing you can do to maintain the security of your Apple products,” Apple spokesperson Sarah O’Rourke told TechCrunch. Older iPhones running updated versions of iOS were not vulnerable to the DarkSword attacks.
Generally, iOS can be updated in the Settings app by tapping General > Software Update. However, Apple has a separate method for installing immediate security patches. This setting is called Background Security Improvements, and is located in Settings > Privacy & Security, then scroll to the bottom to find Background Security Improvements.
Matthias Frielingsdorf of iVerify, told TechCrunch that the new DarkSword spyware has similarities to previous DarkSword versions, and that the GitHub files are so simple that anyone can execute them “in a couple minutes to hours.”
Author: Roman Loyola, Senior Editor, Macworld
Roman is a Macworld Senior Editor with over 30 years of experience covering the tech industry, focusing on the Mac and other products in the Apple ecosystem. He is also the host of the Macworld Podcast. His career started at MacUser, where he received Apple certification as a repair technician (when Apple did that kind of thing). He's also worked for MacAddict, MacLife, and TechTV.