Apple made strides with iOS 26 security, but leaked hacking tools still leave millions exposed to spyware attacks

The communal presumption among iPhone information experts has been that uncovering vulnerabilities and processing exploits for iOS was difficult, requiring a batch of time, resources, and teams of skilled researchers to interruption done its layers of information defenses. That meant iPhone spyware and zero-day vulnerabilities, which aren’t known to the bundle vendor earlier they are exploited, were uncommon and lone utilized successful constricted and targeted attacks, as Apple itself says.

But successful the past month, cybersecurity researchers astatine Google, iVerify, and Lookout, person documented respective broad-scale hacking campaigns utilizing tools, known arsenic Coruna and DarkSword, which person been near-indiscriminately targeting victims astir the satellite who are not yet moving Apple’s astir up-to-date software. Some of the hackers down these attacks see Russian spies and Chinese cybercriminals, and people their victims via hacked websites oregon fake pages, allowing them to perchance bargain telephone information from a ample fig of victims. 

Now, immoderate of these tools person leaked online, allowing anyone to instrumentality the codification and easy motorboat their ain attacks against Apple users moving older versions of iOS. 

Apple has invested important resources successful caller information and improvement technologies, specified arsenic introducing memory-safe codification for its latest iPhone models, and launching features similar Lockdown Mode specifically to antagonistic imaginable spyware attacks. The extremity has been to marque modern iPhones much secure, and to fortify the assertion that the iPhone is precise hard to hack.

But determination are inactive a batch of older, out-of-date iPhones that are present easier targets for spyware-wielding spies and cybercriminals. 

There are present fundamentally 2 information classes of iPhone users. 

Users connected the latest iOS 26 moving connected the astir caller iPhone 17 models released successful 2025 person a caller information diagnostic called Memory Integrity Enforcement, which is designed to halt representation corruption bugs, immoderate of the astir commonly exploited flaws utilized successful spyware and telephone unlocking attacks. DarkSword relied heavy connected representation corruption bugs, according to Google. 

Then, determination are iPhone users who inactive tally the erstwhile mentation of Apple’s mobile software, iOS 18, oregon adjacent older versions, which person been susceptible to memory-based hacks and different exploits successful the past. 

The find of Coruna and DarkSword suggest that memory-based attacks could proceed to plague users of older iPhones and iPads that lag down the newer, much memory-safe models.

Experts moving for iVerify and Lookout, 2 cybersecurity companies that person a commercialized involvement successful selling information products for mobile devices, accidental Coruna and DarkSword whitethorn besides situation the long-held presumption that iPhone hacks are rare.

iVerify’s co-founder Matthias Frielingsdorf told TechCrunch that mobile attacks are present “widespread,” but helium besides said that attacks relying connected zero-days against the astir up-to-date bundle “will ever beryllium charged astatine a premium rate,” implying that these volition not beryllium utilized to hack radical connected a wide scale.

Patrick Wardle, an Apple information expert, said 1 occupation is that radical telephone attacks against iPhones uncommon oregon blase conscionable due to the fact that they are seldom documented. But the reality, helium said, is that these attacks whitethorn beryllium retired determination but are not ever caught. 

“Calling them ‘highly advanced’ is simply a spot similar calling tanks oregon missiles advanced,” Wardle told TechCrunch. “It’s true, but it misses the point. That’s simply the baseline capableness astatine that level, and each (most) nations person them (or tin get them for the close price).”

Another occupation highlighted by Coruna and DarkSword is that determination is present an seemingly thriving “second-hand” market, which creates the fiscal inducement “for exploit developers and idiosyncratic brokers to fundamentally get paid doubly for the aforesaid exploit,” according to Justin Albrecht, main researcher astatine Lookout. 

Especially erstwhile the archetypal exploit gets patched, it makes consciousness for brokers to resell it earlier everyone updates. 

“This isn’t a one-time event, but alternatively a motion of things to come,” Albrecht told TechCrunch.