Job’s Mob fans love to bang on about being safer than Android, right up until a website quietly empties their phone.
The Fruity Cargo Cult Apple has a newly detailed iPhone hacking chain called DarkSword, uncovered by researchers at Google, iVerify and Lookout, and already used in live campaigns.
DarkSword hits iPhones running iOS 18, which still powers close to a quarter of devices last month, and it works as a drive-by that needs only a tainted page view.
iVerify cofounder and CEO Rocky Cole said: “A vast number of iOS users could have all of their personal data stolen simply for visiting a popular website. Hundreds of millions of people who are still using older Apple devices or older operating system versions remain vulnerable.”
Researchers reckon iPhones on iOS 18.4 through 18.7 could be exposed, putting roughly 270 million devices in the firing line, which is quite a crowd for a “walled garden”.
The chain strings together multiple bugs, including holes in WebKit, the iOS kernel and dyld, then escapes the browser sandbox and grabs deep access to the device.
Lookout’s write-up says the attack starts with a malicious iframe, uses WebGPU to jump into a system process and then pulls data out through modified sandbox rules.
The spyware hoovers up the full nosey-neighbour package, including passwords, messages, call logs, location history, photos, and Apple Health data, with a side hustle to look for crypto wallets.
It is not even polite enough to leave an app behind, because it runs through legitimate processes and temporary scripts, then disappears after a restart once the smash-and-grab is done.
Researchers found DarkSword on compromised Ukrainian sites, including a gov.ua domain, and on a fake Snapchat lookalike targeting Saudi Arabian users.
Google says DarkSword has been active since at least November 2025, targeting Ukraine, China, Saudi Arabia, Turkey, and Malaysia, with no reported attacks against American targets.
Job’s Mob patched the underlying flaws across a scatter of releases, culminating in iOS 26.3 in February 2026, which is helpful if your phone is not stuck behind the upgrade treadmill.
Apple spokesperson Sarah O’Rourke stated: “Keeping software up to date remains the single most important thing users can do to maintain the high security of their Apple devices.”
For those who cannot update, Job’s Mob points at Lockdown Mode, an “extreme” setting aimed at a “tiny minority.”
“If this one gets burned, I’ll just go get another one,” Cole said. “They know there’s more where this came from.”
