Ukraine warns of mobile malware campaign with iPhone exploit kit DarkSword

Ukraine's SSSCIP reported growing Russian hacking campaigns targeting smartphones of Ukrainian military personnel and officials. iPhones are hit via the DarkSword exploit kit through compromised news and government websites, while Android devices are infected with CamelSpy and BTMOB malware. CERT-UA recorded 3,137 cyber incidents in the first half of 2026, about 8% more than in the previous six months.

• DarkSword infects iPhones via Safari and iOS flaws on compromised websites
• The kit works as a hit-and-run: steals data in minutes and erases traces
• Groups UAC-0244 and UAC-0263 spread CamelSpy and BTMOB via decoy sites
• CERT-UA logged 3,137 incidents in H1 2026, up 8% from the prior period