A major hacking tool has leaked online, putting millions of iPhones at risk. Here’s what you need to know

Recent investigations by security experts have revealed a surge in cyberattacks targeting Apple users globally. The malicious tools identified, known as Coruna and DarkSword, have been exploited by both state actors and cybercriminals to compromise the security of iPhones and iPads, potentially affecting millions of devices. Historically, significant hacking incidents aimed at iPhone and iPad users have been uncommon, with notable exceptions including attacks against Uyghur Muslims in China and individuals in Hong Kong. However, the leak of these sophisticated hacking tools online has raised alarms, as they pose a threat to hundreds of millions of devices operating outdated software versions. The Coruna and DarkSword toolkits are equipped with a variety of exploits that can infiltrate Apple devices, allowing attackers to access sensitive information such as messages, browsing history, and location data. Researchers have determined that Coruna can target devices running iOS versions 13 through 17.2.1, while DarkSword is capable of exploiting newer devices operating on iOS versions 18.4 and 18.7, which were released in September 2025. The immediate concern lies with DarkSword, as parts of its code were recently leaked on the GitHub platform, providing easy access for those looking to launch attacks against older iOS versions. These attacks are particularly alarming due to their indiscriminate nature; any user visiting a compromised webpage could fall victim. Initial infections can lead to complete control of the device by hackers, who then exfiltrate personal data to their own servers. Notably, some elements of the Coruna toolkit were developed by Trenchant, a cybersecurity unit within the U.S. defense contractor L3Harris, which sells exploits to governmental bodies. Moreover, Kaspersky has linked some tools in Coruna to a sophisticated cyber operation against Russian iPhone users, indicating the complex and often opaque networks through which such exploits circulate. The proliferation of these powerful hacking tools highlights a troubling trend, reminiscent of the 2017 leak of an NSA exploit that facilitated the widespread WannaCry ransomware attack. DarkSword's usage has already been observed in attacks against targets in China, Malaysia, Turkey, Saudi Arabia, and Ukraine, although the origins of the tool remain unclear. As researchers continue to analyze these tools, they have noted that DarkSword is now effectively “plug-and-play,” making it alarmingly easy for malicious actors to deploy. GitHub has stated that while it does not condone the use of such tools for illegal activities, it will not remove the leaked code, citing its educational value. For users of iPhones and iPads, immediate action is advised. Apple has confirmed that devices running the latest iOS versions are protected against these vulnerabilities. Users are encouraged to update to iOS 18.7.6 or iOS 26.3.1 to safeguard their devices. Alarmingly, nearly one-third of iPhone and iPad users are still on outdated software, leaving them exposed to these threats. Apple also promotes Lockdown Mode, an enhanced security feature, which can provide additional protection against such attacks, particularly for those at higher risk, including journalists and activists. As the cybersecurity landscape evolves, staying informed and vigilant is crucial for protecting personal data from emerging threats.