Researchers have discovered a new attack kit that can compromise iPhones via infected websites without users noticing or installing anything.
The tool, DarkSword, installs itself on iPhones using a fileless technique. It then steals data such as WhatsApp messages and passwords. This was discovered by Google Threat Intelligence Group, Lookout, and iVerify, among others, and is already being actively used in several countries.
Attack via infected websites
Instead of targeted phishing attacks, DarkSword uses a so-called watering hole approach, according to TechRepublic. This involves hacking websites that targets already visit, automatically infecting visitors. For example, Ukrainian news and government websites were used to attack visitors with iPhones running older iOS versions (18.4 to 18.6.2).
Fileless attack steals sensitive data
The attack is notable because it works filelessly. No malware is installed on the device; instead, existing iOS processes are exploited to steal data. Within minutes, the tool can collect passwords from iCloud Keychain, messages from iMessage, WhatsApp, and Telegram, photos, emails, browser history, health data, and notes.
Additionally, the attack explicitly targets crypto wallets such as Coinbase and MetaMask. Once the attack is executed, the tool removes traces such as crash logs and temporary files. After users restart their iPhone, the malware is gone, but the stolen data remains compromised.