News

DarkSword malware targets iPhones that haven’t been updated yet

The security holes have all been patched as of iOS 18.7.3 and later.
Roman Loyola
By Roman Loyola
Senior Editor, Macworld MAR 19, 2026 9:42 am PDT
iPhone security
Image: IDG
Summary created by Smart Answers AI

In summary:

  • Macworld reports on DarkSword malware targeting iPhones running iOS versions 18.4 through 18.7, exploiting six security vulnerabilities to steal data and track users.
  • Google’s Threat Intelligence Group discovered this malware toolkit creates three families called Ghostblade, Ghostknife, and Ghostsaber, spreading through malicious websites.
  • All vulnerabilities have been patched in iOS 26.3 and earlier versions, making immediate iPhone updates crucial for protection.

The Google Threat Intelligence Group has posted a report about malware that uses six different security vulnerabilities to attack an iPhone. According to the report, a toolkit called DarkSword has been used to create three malware families called Ghostblade, Ghostknife, and Ghostsaber, and iPhones running iOS 18.4 to 18.7 are vulnerable.

All of the security holes used by the DarkSword malware have been fixed as of iOS 26.3 (the current version is iOS 26.3.1); most of them were fixed before 26.3. The latest version of iOS is 18.7.6, released on March 4. GTIG notes that the threat actors using DarkSword targeted users in Malaysia, Saudi Arabia, Turkey, and Ukraine.

DarkSword creates malware that uses JavaScript, and the attacker doesn’t need access to your device. Rather, a threat agent embeds the code within a website. When the user visits the website, the JavaScript executes and installs malware on the iPhone that can gather the user’s personal data, record audio, or check GS data for the current location. The information is then uploaded to a remote server.

The exploits used by DarkSword were recorded in the Common Vulnerabilities and Exposures database as the following:

iPhone viruses and malware are rare, but no device is completely invulnerable. Apple urges users to update to the most recent version of iOS that a device can support to ensure that the latest security patches are installed. Learn more about iPhone malware and viruses. We also have tips on how to protect your phone from hackers.

, Senior Editor, Macworld

Roman is a Macworld Senior Editor with over 30 years of experience covering the tech industry, focusing on the Mac and other products in the Apple ecosystem. He is also the host of the Macworld Podcast. His career started at MacUser, where he received Apple certification as a repair technician (when Apple did that kind of thing). He's also worked for MacAddict, MacLife, and TechTV.

Recent stories by Roman Loyola: