CUPERTINO, CALIFORNIA — Apple began encouraging iPhone users to update their software due to new cybersecurity research that revealed hacking tools being used to compromise older devices. The company released a special software update for older iPhone devices that cannot fully upgrade to iOS 26 to block hackers from using DarkSword and Coruna.

Russian intelligence, Chinese cybercriminals and other hackers have been using tools nicknamed DarkSword and Coruna to take over phones running older versions of iOS. The tools can give hackers deep remote access to victims' phones and allow them to search through their contents. DarkSword appears to be a surveillance and intelligence gathering tool that pulls data including Wi-Fi passwords, text messages, call history, root location history, browser history, SIM card and cellular data, as well as health, notes and calendar databases.

On March 18, 2026, researchers at Google, iVerify and Lookout announced the discovery of DarkSword. DarkSword does not affect the latest updated versions of iOS but works against devices running iOS 18, which accounted for close to a quarter of iPhones as of last month. "A vast number of iOS users could have all of their personal data stolen simply for visiting a popular website," said Rocky Cole, cofounder and CEO.

Apple's operating system iOS 26 was released in September and protects users against both hacking campaigns. The tools can only work against devices running older versions of Apple's operating system, a spokesperson said. "Keeping software up to date remains the single most important thing users can do to maintain the high security of their Apple devices," said Sarah O'Rourke, spokesperson.

Both hacking campaigns infect phones through a watering hole attack, where a website is designed or hacked to include code that exploits how phones process web traffic and can automatically infect vulnerable phones that visit it. The tools could also easily be used to hack anyone whose iOS is out of date, a senior researcher at Citizen Lab said. "The barrier to entry for widespread, devastating mobile attacks has been decisively lowered," said John Scott-Railton, senior researcher. "It's clear this problem is only going to grow. The scary takeaway for regular users is they can't spot this attack."

Research from Google, iVerify and Lookout shows several groups were targeted by the iPhone hacking tools: Ukrainians targeted by Russian intelligence; Chinese cryptocurrency users; and people in Saudi Arabia, Turkey and Malaysia. Hackers associated with Russian intelligence deployed Coruna last summer to target Ukrainians. By December, Chinese cybercriminals had obtained Coruna and created a large set of fake Chinese finance-related websites with the intent of stealing cryptocurrency.

Users who enable iOS's strictest security setting, Lockdown Mode, are protected from DarkSword and Coruna. Hacking an iPhone is still a technical challenge, and the two campaigns rely on a complicated chain of hacks that work in tandem to take over a phone.