Leaked hacking tools expose millions of iPhone users to spyware

In the last month, cybersecurity researchers at Google, iVerify, and Lookout documented several broad-scale hacking campaigns using tools known as Coruna and DarkSword. These campaigns have exposed millions of users around the world to spyware attacks. The discovery directly challenges the assertion by Apple that iPhone spyware and zero-day vulnerabilities—defined as vulnerabilities unknown to the software vendor before they are exploited—were rare and only used in limited and targeted attacks. Instead, these newly documented campaigns have targeted victims who are not running Apple’s most up-to-date software.

To counter these threats, Apple has introduced new security features, but protection remains uneven. Users running iOS 26 on iPhone 17 models released in 2025 have access to Memory Integrity Enforcement. This feature is designed to stop memory corruption bugs, which are the software flaws commonly used in spyware and phone unlocking attacks. According to Google, the DarkSword tool relied heavily on these memory corruption bugs. However, users on older software, such as iOS 18, lack these protections. Because of this gap, memory-based attacks could continue to plague users of older iPhones and iPads.

The hacking campaigns involve various actors, with some of the attacks attributed to Russian spies and Chinese cybercriminals. Matthias Frielingsdorf, co-founder of iVerify, stated that mobile attacks are now widespread, though he noted that zero-day attacks against the most up-to-date software will always be charged at a premium rate. Patrick Wardle, an Apple security expert, cautioned against labeling these exploits as unusually sophisticated simply because they are rarely documented. Wardle explained, “Calling them ‘highly advanced’ is a bit like calling tanks or missiles advanced. It’s true, but it misses the point. That’s simply the baseline capability at that level, and all (most) nations have them (or can acquire them for the right price).”

This baseline capability has fueled a secondary market for mobile exploits. Justin Albrecht, principal researcher at Lookout, warned that the leak of these tools creates a financial incentive for exploit developers and brokers to resell the same exploit multiple times before a patch is widely adopted. According to Albrecht, this dynamic is not a one-time event, but a sign of things to come.

Why it matters

The leak of Coruna and DarkSword challenges the long-held assumption that iPhone hacks are rare. This exposure creates a financial incentive for brokers to resell exploits, signaling a shift in the mobile security landscape.