How the DarkSword Exploit is Targeting Kenyan Apple Users via Safari
Kenya’s “iPhone Gang” is currently facing a massive security headache following the discovery of a sophisticated new hacking tool dubbed “DarkSword.” Security researchers from Google, Lookout, and iVerify have sounded the alarm on this powerful exploit, which is already being used by Russian state-sponsored actors and international spyware vendors. Unlike traditional hacks that require you to download a suspicious file, DarkSword is a “zero-click” threat that can fully compromise an iPhone running iOS 18.4 through 18.7 simply by the user visiting a compromised website.
For the millions of Kenyans who rely on iPhones for daily business, the stakes couldn’t be higher. This isn’t just about someone reading your texts; DarkSword is designed to strike fast and clean. It executes entirely in JavaScript, bypassing Apple’s security layers to gain “kernel-level” access. Once inside, the tool can exfiltrate everything from iMessage and WhatsApp chats to photos and sensitive health data in less than sixty seconds before deleting itself to hide its tracks.
With the rise of mobile banking and the heavy use of apps like M-PESA, Binance, and Telegram in Kenya, our devices are digital goldmines. Hackers are increasingly using “watering hole” attacks—infecting legitimate local websites like news portals or government domains—to catch unsuspecting visitors. Because DarkSword can target cryptocurrency wallets and financial apps like Coinbase and Kraken, a single visit to a compromised Kenyan blog or service site could lead to a cleared account before you even realize you’ve been targeted.
Alarmingly, experts estimate that nearly 270 million iPhones worldwide are currently vulnerable. In Kenya, where many users tend to delay software updates due to data costs or a “if it isn’t broken, don’t fix it” mentality, the risk is amplified. Even more chilling is the evidence that these hackers may be using AI to lower the barrier for entry, meaning this “nation-state” level technology could soon trickle down to local cybercriminals looking to exploit the Kenyan digital economy.
If you are using an iPhone in Kenya, do not ignore that “Software Update” notification. The most important step you can take is to check your settings immediately and ensure your iPhone is running at least iOS 18.7.6 or, ideally, the latest iOS 26.3.1. Apple has already patched the specific vulnerabilities DarkSword uses in these later versions, so staying on outdated software is like leaving your front door wide open.
For those who feel they are at higher risk, such as journalists, activists, or business leaders, enabling Lockdown Mode in your Privacy & Security settings is a highly recommended move. This “extreme” protection has been confirmed to block the DarkSword exploit by disabling the specific web features hackers use to enter. Additionally, be extremely wary of “trending” links sent via WhatsApp groups or SMS, as these are often the primary vectors used to direct victims to infected websites.