TA446 uses leaked DarkSword iOS kit in spear-phishing campaign

What happened

Security reporting published in the last 24 hours indicates that TA446 (also tracked as COLDRIVER / Star Blizzard) used lures and infrastructure associated with the leaked DarkSword iOS exploit ecosystem during a spear-phishing operation.

The campaign appears to combine familiar social engineering (fake invitation-style messages) with mobile-focused compromise paths, which raises risk for people who still use older iOS versions.

Why this matters

This is important because it lowers the barrier for mobile-targeted attacks:

iOS exploit tooling that was once highly specialized is being reused in broader operations.
Spear-phishing remains the delivery mechanism, so regular users can still be pulled in by a convincing message.
If a target device is unpatched, attackers may move from a simple click to deeper data theft.

How to check if you’re affected

Confirm your iPhone/iPad software version now
- Go to Settings → General → Software Update.
- Affected versions: iOS/iPadOS versions before the latest Apple security release should be treated as potentially exposed and updated immediately.
- Install the latest iOS/iPadOS update available for your device.
Review unusual message/email prompts from the last 7 days
- Be suspicious of “invitation,” “urgent document,” or “security verification” links.
- If you clicked one, do not revisit it; capture the sender and URL details for review.
Check for account abuse signs
- Review Apple ID sign-ins and trusted devices.
- Change Apple ID password if you see unknown activity.
- Ensure two-factor authentication is enabled.
If you are a high-risk target (journalist, activist, policy/government, legal, research)
- Assume higher exposure to tailored lures.
- Move sensitive communications to hardened channels and seek device forensic review if suspicious behavior appears.
Apply organization-level protections
- Block known malicious indicators from vendor reports.
- Increase monitoring for mobile phishing campaigns and credential theft attempts.

Immediate defensive actions

Patch all iOS/iPadOS devices to current releases.
Treat unexpected “discussion invite” or “document review” messages as hostile until verified out-of-band.
Rotate credentials for any accounts accessed from a potentially exposed mobile device.

Sources

Bottom line

Even if the campaign is targeted, the practical user action is simple: update iOS immediately and treat unexpected link-driven invitations as potential phishing. In mobile threat cycles, patch delay is often the difference between a blocked attempt and a compromise.