Are you looking for a holiday? Get special deals.

DarkSword leak puts millions of iPhone users at risk

28 Mar 2026 By foxnews

Last week, researchers warned about a sophisticated iPhone hacking tool called DarkSword. Now the situation has escalated. A newer version of that tool has been leaked online and posted to a public code-sharing site. That changes everything. What was once limited to advanced attackers is now far easier to access and use. Security experts say this could quickly turn into a widespread threat, especially for people using older Apple software.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you'll get instant access to my Ultimate Scam Survival Guide - free when you join my CYBERGUY.COM newsletter

DON'T IGNORE APPLE'S URGENT SECURITY UPDATE

Before the leak, tools like DarkSword required skill, resources and time. Now, much of that barrier is gone. The leaked version is surprisingly simple. It uses basic web technologies like HTML and JavaScript. That means someone with minimal experience could copy the code, host it and launch an attack in a short amount of time. Researchers say the exploits can work right away with little setup. No deep knowledge of iOS is required. That is the real shift here. The tool itself did not suddenly become more powerful. It became easier to use.

This is where the numbers get concerning. DarkSword targets iPhones and iPads running older operating systems, especially iOS 18 and earlier. According to Apple's own data, a large share of active devices still falls into that group. With billions of Apple devices in use worldwide, that could leave hundreds of millions of users exposed. Apple says these attacks specifically target outdated versions of iOS, often through malicious links or compromised websites. If your device is not updated, it could be vulnerable.

This is not a minor nuisance. The leaked code includes instructions for pulling sensitive data directly from a device. Once it gains access, it can:

There are also references to activity that happens after the initial compromise, which suggests attackers can dig deeper once they are inside. In simple terms, this is full access to your digital life.

Apple has already addressed the issue for newer devices. The company pushed updates that block these attacks on current versions of iOS. It also released a security update for older devices that are unable to run the latest version of iOS. Apple says these attacks target out-of-date software and can be triggered through malicious links or compromised websites. If your iPhone is up to date, you are already protected. Apple also says keeping your software updated is the single most important step you can take to protect your device. Devices running the latest versions of iOS were not at risk from these attacks. For older devices, Apple released updates on March 11, 2026, to extend protections. Devices running iOS 13 or iOS 14 must update to iOS 15 to receive those protections.

We reached out to Apple for comment, and the company pointed us to its official security guidance at support.apple.com/en-us/126776 for more details.

THOUSANDS OF IPHONE APPS EXPOSE DATA INSIDE APPLE APP STORE

If you have been putting off software updates, now is the time to stop. This situation shows how quickly a targeted threat can turn into a mass risk. Once tools like this are public, they spread fast. Even if you are not specifically being targeted, attackers can automatically scan for vulnerable iPhones and go after them in large numbers.

A quick check can make a big difference:

If this sounds concerning, it should. The good news is that there are a few simple steps that can significantly reduce your risk.

As I mentioned above, this is the most important step. Apple has already patched the vulnerability in newer versions of iOS. If your device is updated, you are protected from this specific attack.

Lockdown Mode is designed for high-risk situations, but anyone can use it. It limits certain features that attackers often rely on.

Go to Settings > Privacy & Security > Lockdown Mode to enable it.

Keep in mind: Lockdown Mode is an extreme security setting. It restricts some apps, websites and features, and certain functions may not work as expected while it is turned on.

Many of these attacks rely on you to click on malicious links or open a compromised website. If you receive a strange link in a message or email, do not tap it. Also, use strong antivirus software to help detect malicious links and block suspicious activity before it can compromise your device. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

YOUR PHONE SHARES DATA AT NIGHT: HERE'S HOW TO STOP IT

Even if your iOS is current, outdated apps can still create security gaps. Regular updates close those openings.

If your personal information is already circulating online, it can make you an easier target. Data removal services help delete your details from data broker sites, which reduces the amount of information attackers can access in the first place. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Set a strong passcode, enable Face ID or Touch ID and avoid using public Wi-Fi without protection. These steps add another layer of defense.

Some identity theft companies can alert you if your personal data is exposed or being used without your knowledge. That can help you act faster if something goes wrong. See my tips and best picks on Best Identity Theft Protection at Cyberguy.com

This is one of those moments where a simple step makes a real difference. Keeping your phone updated is easy to put off, but it is one of the most effective ways to stay protected. When tools like DarkSword become widely available, outdated devices stand out as easy targets. This is real, and it is happening now. So, update your iPhone today.

So here is the bigger question. If a basic update can block a serious attack, what is stopping people from doing it? Let us know by writing to us at Cyberguy.com