Russia-linked APT TA446 uses DarkSword exploit to target iPhone users in phishing wave

Russia-linked APT TA446 has been observed using the DarkSword iOS exploit kit in targeted spear-phishing campaigns against iPhone users, leveraging malicious links and spoofed Atlantic Council invitations to harvest credentials and collect intelligence; researchers tied observed domains, a VirusTotal loader MD5, and campaign infrastructure to the actor and noted expanded targeting across government, think tanks, NGOs, and other high-value sectors.