Russians caught stealing personal data from Ukrainians with new advanced iPhone hacking tools

Cybersecurity researchers at Google, iVerify, and Lookout uncovered a new iPhone hacking toolkit called Darksword, attributed to a suspected Russian government-linked group (UNC6353) targeting Ukrainian users. The toolkit was designed to steal passwords, photos, messages, browser history, and potentially cryptocurrency from wallet apps, then quickly disappear from devices — with dwell time measured in minutes. Darksword is linked to an earlier toolkit called Coruna, originally developed by U.S. defense contractor L3Harris. The campaign targeted anyone visiting certain Ukrainian websites from within Ukraine, suggesting broad rather than targeted surveillance. Researchers debate whether the crypto-theft capability indicates financial motivation or expansion of Russian state-aligned activity into financial theft.