A New Zero-Click Mobile Exploit Is Hitting iPhones. Here’s What DarkSword Means for Federal and DoD Security

A new mobile exploit named DarkSword, discovered in the wild just days ago, represents a meaningful shift in mobile threat sophistication: a zero-click exploit capable of fully compromising an iPhone, without any action from the user. Discovered in the wild by researchers at Google, Lookout, and Malwarebytes, this highly sophisticated threat targets hundreds of millions of unpatched iPhones. It is currently being wielded by multiple threat actors—including commercial spyware vendors and state-sponsored groups—for both surveillance and rapid financial gain.

The Anatomy of a Zero-Click Heist: DarkSword

DarkSword targets devices running iOS 18.4 through 18.7 (versions released between March and September 2025) meaning any device that hasn’t been updated in the past six months is potentially exposed. What makes it particularly chilling is its “Zero-Click Drive-By” method: infection happens silently in the background. Simply visiting a compromised, legitimate website via Safari triggers the exploit without requiring the user to click a malicious link or download an app.

The exploit chains together six different vulnerabilities, including zero-days in Safari’s WebKit and the iOS kernel, to break out of the browser’s security sandbox and seize full control of the device. Unlike traditional spyware that hides on a device for months, DarkSword executes in minutes—it force-loads scripts, exfiltrates data, and then wipes its own tracks to completely evade forensic detection. It specifically targets high-value data such as cryptocurrency wallets, saved passwords, secure messages (WhatsApp, iMessage), photos, and location history.

Why Mobile Security Is Now a Federal Priority

DarkSword isn’t an outlier, it’s a signal. The sophistication, speed, and zero-interaction nature of this exploit reflect where the broader mobile threat landscape is heading. And increasingly, both lawmakers and defense standards bodies are arriving at the same conclusion: mobile devices have been a blind spot in federal security posture for too long.

Two key developments:

• The 2026 National Defense Authorization Act includes specific mobile security mandates for the first time, requiring hardened devices for senior officials, continuous monitoring capabilities, and enhanced protections against device tracking. The NDAA also includes a 4.1% increase in military cyber funding, bringing the total to approximately $15.1 billion. This reflects a growing recognition at the legislative level that threats like DarkSword represent a category of risk that existing frameworks weren’t built to address — a point underscored by recent “Signalgate” incidents, where sensitive information about US aircraft strikes was shared over unsecured private devices.
  
• DISA has arrived at the same place through the technical side. Recent updates to the Security Technical Implementation Guides (STIGs) for Apple iOS/iPadOS and Android now formally require Mobile Threat Defense (MTD) solutions on every DoD-managed device — moving MTD from a best practice to a compliance requirement, with formal findings consequences for non-deployment. Specifically, MTD apps must provide real-time threat detection, malware prevention, and vulnerability analysis across devices, networks, and applications.

Together, these developments signify that the era of treating mobile security as secondary to endpoint and network defense is over. The question for Federal and DoD IT leaders is no longer whether to deploy dedicated mobile threat protection — it’s how to do it in a way that satisfies both the mandate and the threat.

Trellix Mobile Security

To meet these rigorous federal mandates and combat the evolving threat landscape, organizations require a robust MTD solution. Trellix Mobile Security is designed to provide the continuous monitoring and real-time protection required by the 2026 NDAA and DISA STIGs.

Trellix Mobile Security offers a comprehensive suite of capabilities to secure the mobile enterprise:

• Advanced Threat Detection: Utilizes machine learning-based on-device detection to identify known and unknown threats in real-time, even when the device is offline.
• Vulnerability Management: Provides deep visibility into the device’s security posture, identifying out-of-date operating systems, risky system configurations, and missing security patches.
• Network Security: Monitors for “Man-in-the-Middle” (MitM) attacks, rogue Wi-Fi hotspots, and certificate hijacking to ensure secure communications.
• Application Risk Assessment: Analyzes applications for malicious behavior, privacy leaks, and security vulnerabilities before and after they are installed on the device.
• Phishing Protection: Detects and blocks malicious URLs in real-time across SMS, email, and messaging apps to prevent credential theft.
• Seamless Compliance: Integrates with leading Unified Endpoint Management (UEM) providers to automate remediation and ensure all devices remain in a compliant state according to STIG requirements.

By deploying Trellix Mobile Security, organizations gain the “continuous monitoring” capability mandated by the NDAA while satisfying the STIG’s requirement for a managed MTD application. In an era where mobile exploits can exfiltrate national security data in minutes, having a dedicated layer of mobile defense is a mission-critical requirement.

Would you like to see how Trellix Mobile Security works and understand more about meeting STIG requirements? 

Reach out to our team today to schedule a meeting.