Russia-linked hackers use advanced iPhone exploit to target Ukrainians

Researchers attributed a sophisticated iPhone malware campaign called DarkSword to UNC6353, a likely Russia-linked threat actor, that used watering-hole attacks and iOS exploits (including the Coruna chain) to rapidly compromise devices, steal emails, messages, photos, credentials and cryptocurrency wallet data, then erase traces; activity affected Ukrainian sites and victims in multiple countries and leveraged high-end exploits later patched by Apple in late 2025.