Security News

Russian Hackers Deploy iPhone Exploit Kit and Malicious Android Apps in Espionage Campaign

The Record · 1 Oct 2026

Key Takeaway Businesses should ensure staff keep phone operating systems and browsers fully updated and avoid clicking links from unfamiliar or unofficial websites, as these can be used to silently compromise devices.

A report from Ukraine's State Service of Special Communications and Information Protection has revealed an escalating campaign by Russian-aligned hackers targeting smartphones belonging to military personnel, government officials and civilians. The attackers use both Android and iOS tools, including a notable exploit kit called DarkSword designed to compromise iPhones with little or no action from the victim.

DarkSword has been used in watering-hole attacks, where legitimate websites likely to be visited by targets, such as news outlets and government sites, are compromised to exploit vulnerabilities in Apple's Safari browser and iOS. Once a device is infected, attackers can steal login credentials, messages, contacts and call histories. Unlike traditional spyware that lingers on a device, DarkSword works quickly, extracting data within minutes and then erasing traces of the intrusion, according to security firm Lookout, which has tracked this activity since late 2025.

Separately, two newer groups, UAC-0244 and UAC-0263, have been spreading malicious Android apps through fake websites impersonating military units and other organisations, tricking users into downloading harmful software under the guise of tests or services.

mobile security espionage iOS exploit Android malware Ukraine

Primary source cip.gov.ua ->

Summarised by CISO AI from The Record. We link back to every original so you can read it yourself.