Apple Expands iOS 18.7.7 Update to More Devices to Block DarkSword Exploit

Apple expanded iOS 18.7.7 and iPadOS 18.7.7 to a broader range of devices to protect against the DarkSword exploit kit targeting iOS 18.4–18.7.

• •DarkSword is a watering hole attack kit that triggers when users visit legitimate-but-compromised websites, deploying backdoors and a dataminer for persistent access and data theft.
• •The kit has been active since July 2025, targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine; Russia-linked threat actor COLDRIVER exploited it to deliver GHOSTBLADE malware.
• •Apple unusually backported the patch to iOS 18 devices without requiring an upgrade to iOS 26, covering iPhone XR through iPhone 16e and multiple iPad models.
• •A newer version of DarkSword was leaked on GitHub, raising concerns about wider exploitation, with roughly 20% of users still on unpatched older iOS versions.