DarkSword iOS Exploit Chain Widely Used Since Late 2025, Google Says

Google has reportedly identified an iOS exploit chain dubbed DarkSword that security researchers say has been actively used since late 2025 to compromise iPhones, prompting Apple to patch at least three linked vulnerabilities across two separate security updates.

The disclosure centers on a chain of vulnerabilities that, when combined, allowed attackers to gain deep access to iPhones running older versions of iOS. Secondary reporting attributes the discovery to Lookout, with validation from Google’s Threat Intelligence Group and mobile security firm iVerify.

Lookout researchers described the tooling as “highly sophisticated and appears to be a professionally designed platform enabling rapid development of modules,” according to Apple’s security advisory documentation and industry coverage of the findings.

What Apple has confirmed about the underlying vulnerabilities

Apple’s own security advisories provide the strongest confirmed evidence. The company acknowledged that CVE-2025-14174 and CVE-2025-43529 were exploited in “an extremely sophisticated attack against specific targeted individuals” running versions of iOS before iOS 26.

A third vulnerability, CVE-2026-20700, affecting the dyld component, was patched in iOS 26.3 and iPadOS 26.3 on February 11, 2026. Apple explicitly linked this CVE to the same attack activity reported alongside the two earlier fixes.

3

That cross-referencing is significant. It confirms Apple treated all three vulnerabilities as part of one coordinated exploitation effort, not isolated bugs found independently.

Rocky Cole, co-founder of iVerify, told reporters the exploit chain is “highly sophisticated, took millions of dollars to develop.” That cost estimate aligns with the broader pattern of state-level or commercial spyware vendors producing iOS exploit chains for high-value targets.

What remains unconfirmed

While Apple’s advisories confirm the exploited CVEs and their targeted nature, several claims in the broader reporting lack direct primary-source backing. The name “DarkSword” itself does not appear in any accessible first-party Google publication identified during research for this article.

The characterization that the chain has been “widely used” also comes from secondary reporting rather than Apple’s advisories, which describe attacks against “specific targeted individuals.” Industry coverage has cited figures suggesting more than 220 million iPhones could be vulnerable, but that number reflects the pool of devices running older iOS versions, not confirmed compromises.

Secondary sources report that the full chain involves six CVEs, including CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520, but these additional identifiers were not independently verified against an official incident write-up during this review.

Why iPhone exploit chains command outsized attention

iOS exploit chains are among the most valuable and consequential findings in security research. Apple’s locked-down ecosystem means that a working chain of vulnerabilities capable of bypassing multiple layers of protection typically requires significant resources to develop.

The concern escalates when tooling designed for targeted surveillance begins appearing in broader criminal use. Security coverage of DarkSword has flagged exactly this risk, noting that sophisticated iPhone exploit kits have previously intersected with crypto-related scams and financial fraud targeting high-net-worth individuals.

Apple’s advisories do not specify the delivery method, whether the exploits required user interaction, or which specific threat actor deployed them. Those gaps leave open questions about whether average users face practical risk or whether the chain remains confined to high-value targeting.

For users holding digital assets on mobile devices, the disclosure reinforces the importance of keeping iOS updated. Exploit chains targeting older software versions are a recurring theme in mobile security incidents, and the growing intersection of mobile platforms and crypto custody means compromised devices can translate directly into financial loss.

What to watch after the DarkSword disclosure

Several follow-up developments will determine how significant this story becomes. The most immediate is whether Google’s Threat Intelligence Group, Lookout, or iVerify publish detailed technical write-ups naming the full exploit chain and providing indicators of compromise.

Affected iOS versions are another key variable. Apple’s patches in December 2025 and February 2026 addressed the known CVEs, but the scope of vulnerable devices depends on adoption rates for iOS 26 and later updates. Apple has not published specific guidance beyond the standard recommendation to update.

Attribution remains open. Apple’s advisories describe the attacks as “extremely sophisticated” without naming a threat actor. Whether the tooling traces back to a commercial spyware vendor, a state-sponsored group, or another category of attacker will shape both the regulatory response and the practical risk assessment for different user populations.

Industry observers have recommended that users concerned about targeted attacks enable Apple’s Lockdown Mode, a feature designed to reduce the attack surface on iOS devices by disabling certain functionalities. Whether Apple issues additional mitigations beyond the existing patches is another open question.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.