More troubling is its method. DarkSword often employs “fileless” techniques, hijacking legitimate system processes rather than installing persistent malware. This makes detection difficult and enables rapid, “smash-and-grab” data extraction within minutes of infection.
The tool has reportedly been deployed in targeted campaigns across regions, including Eastern Europe, the Middle East, and Southeast Asia, underscoring the growing overlap between commercial surveillance markets and geopolitical cyber operations.
Apple has since patched the exploited vulnerabilities, urging users to update their devices. Yet the episode highlights a broader shift: once rare, high-end iPhone exploits are becoming scalable and reusable. In the emerging cyber-arms market, even the most secure consumer devices are no longer beyond reach.
