iPhone users at risk as new exploit steals data via web links

Google and cybersecurity firms have identified a new exploit targeting iPhones that can extract sensitive data when users visit compromised websites. The tool, referred to as DarkSword, exploits multiple vulnerabilities in iOS versions 18.4 to 18.7, according to findings by Google Threat Intelligence Group, Lookout and iVerify. 

The attack does not require users to install any software, relying instead on web-based access to infiltrate devices.

Data from Apple indicates that around 25% of iPhones are still running affected versions, potentially leaving a large number of devices exposed.

Once triggered, the exploit can collect a wide range of data, including contacts, call logs, messages, emails, photos, browsing history, location information, account credentials and financial data. Information from applications such as WhatsApp and Telegram, as well as cryptocurrency wallets, may also be accessed.

Researchers said the tool operates for a short duration, extracting targeted data before removing traces of its activity. The process typically lasts only minutes, making detection difficult. Restarting the device can remove most visible signs of the exploit.

Unlike traditional spyware designed for continuous surveillance, DarkSword focuses on rapid data extraction. Investigators noted that the code has been left accessible, raising concerns about wider use and replication by other actors.

Security experts advise users to update their devices to the latest iOS version and avoid visiting untrusted websites to reduce exposure to such exploits.