Official HLD press statement
Independent researchers and Google Threat Intelligence have documented a sophisticated iOS exploit chain referred to as DarkSword. It has been used in real campaigns by multiple actors, which means the risk is not theoretical—it is an operational capability in the wild.
HLD ORD (Offensive Research Division) has investigated this incident end-to-end, correlating open-source intelligence with controlled work in closed laboratory environments. That validation confirms the real-world impact: vulnerable iOS builds remain exposed to browser-mediated compromise, and post-exploitation behaviour aligns with the data-access and persistence patterns described in public reporting. HLD is treating this as an active, high-priority risk—not a paper exercise—and we are briefing clients and the public with the same urgency we apply internally.
HLD’s guidance is straightforward: treat unpatched iPhones on affected iOS versions as exposed to drive-by compromise via the web stack. Patching closes the underlying flaws; awareness reduces risky browsing on unmanaged devices until updates are applied.
Organisations should push managed devices to the latest supported iOS build, communicate clearly to staff and contractors who use personal iPhones for work mail or MFA, and align incident response playbooks for suspected mobile compromise.