Researchers from Google, Lookout, and iVerify discovered a Russia-aligned hacking campaign targeting iPhones in Ukraine. The group utilizes a new advanced spyware toolkit named Darksword.
Attackers compromise Ukrainian websites to deliver exploits to geolocated devices via a watering-hole strategy. The campaign's motives include a combination of espionage and financial gain.
Darksword extracts passwords, message histories, and photos within minutes. The malware also targets cryptocurrency wallet data before self-removing to evade detection.
The toolkit shares infrastructure with a previously identified exploit kit called Coruna. Apple patched the vulnerabilities in recent iOS updates following notification from the research teams.