A powerful software exploit capable of penetrating and stealing information from potentially hundreds of millions of Apple iPhones was planted on dozens of websites in Ukraine in recent weeks, researchers said on Wednesday.

The discovery marks the second time this month that researchers have found spyware targeting iPhones and other Apple devices. Together, the two hacking tools show that the market for sophisticated malware capable of stealing data and cryptocurrency wallet information is flourishing, researchers said.

Read more-iPhone 18 design, camera and prices: Details, other Apple launches revealed

Researchers with cyber firm Lookout, mobile security firm iVerify and Alphabet’s Google published coordinated analyses of the malware they dubbed “Darksword.” On March 3, Google and iVerify revealed a separate powerful iPhone spyware called “Coruna.” Researchers found Darksword hosted on the same servers.

“There’s now a verified pipeline of recent exploits … that have ended up in the hands of potentially criminal entities with a financial focus,” said Justin Albrecht, principal researcher with Lookout.

Google flags wide-ranging hacking campaigns

Google said its researchers observed multiple commercial vendors and suspected state-linked hackers using Darksword in distinct campaigns against targets in Saudi Arabia, Turkey, Malaysia and Ukraine.

The campaigns in Malaysia and Turkey were associated with Turkish commercial surveillance vendor PARS Defense, Google said. PARS Defense did not respond to a request for comment.

According to iVerify and Lookout, researchers discovered the malware being delivered to iPhone users running iOS versions 18.4 to 18.6.2 who visited one of dozens of Ukrainian websites. Apple released those versions between March and August 2025.

It’s not clear how many iPhones are vulnerable to Darksword attacks, the researchers said. Apple has released multiple fixes for the underlying bugs attackers used to make Darksword. Nevertheless, many people don’t install iPhone updates, and an estimated 220 million to 270 million iPhones still run exposed iOS versions, according to iVerify and Lookout, which based the figures on public estimates. Google did not share its findings ahead of Wednesday’s report.

An Apple spokesperson said the exploits targeted “out-of-date software,” and that the underlying vulnerabilities have been addressed across multiple updates over the last several years for users running the latest versions of their devices’ operating systems.

“Keeping software up to date remains the single most important thing users can do to maintain the high security of their Apple devices,” the spokesperson said.

Additionally, all malicious domains identified by Google are blocked by Apple Safe Browsing in the Safari web browser to prevent further exploitation, the spokesperson said.

The discovery of two distinct powerful iOS exploits this month suggests a robust ecosystem for tools that were previously limited primarily to state-level intelligence operations, said Rocky Cole, co-founder and COO of iVerify.

Researchers said they discovered the vulnerabilities because of sloppy security mistakes not common in state-linked iPhone hacking.

“The fact that they don’t care if it gets burned, and that they’re using them in mass attacks with poor (operational security), that says a lot about how much they value these tools,” Cole said. “They’re not overly precious about them being exposed.”

Darksword was found on the internet servers that suspected Russian operators of Coruna used, researchers with iVerify and Lookout said in findings and interviews ahead of Wednesday’s release.

Eid Al Fitr will begin in the UAE on Friday after the Shawwal crescent moon was not sighted on Wednesday evening, authorities confirmed.

The country’s Moon-sighting committee, made up of senior religious scholars, officials and astronomers, gathered to observe the new crescent moon marking the end of Ramadan and the start of Shawwal, the 10th month of the Islamic calendar.

As the moon was not visible, Thursday, March 19, will be the 30th and final day of Ramadan this year, meaning Eid Al Fitr will begin on Friday.

The UAE Council for Fatwa had earlier called on the public to look to the skies to help sight the moon.

Eid Al Fitr is one of the two major feasts celebrated by Muslims worldwide. It is traditionally marked by morning prayers, family gatherings, charitable giving and the exchange of gifts.

This year’s festival comes against the backdrop of heightened regional tensions, with the UAE and other Gulf countries continuing to face attacks from Iran.

Authorities have also confirmed that Eid Al Fitr prayers will be held indoors in the UAE, rather than at prayer grounds or in open areas, as a safety measure.

The decision was taken by the Islamic Affairs and Charitable Activities Department in Dubai in co-ordination with the Department of Islamic Affairs in Sharjah.

“The Authority calls on worshippers to adhere to the guidelines and arrive early to perform the Eid prayer in mosques to ensure their safety,” the government media office said on social media.

Extended break for workers

Public and private sector workers in the UAE are also set for a long weekend for Eid Al Fitr.

The Federal Authority for Government Human Resources and the Ministry of Human Resources and Emiratisation had earlier announced that the holiday for workers would begin on Thursday, March 19.

Work is scheduled to resume on Monday, March 23, giving employees across both sectors a four-day break for the holiday.

Air India and Air India Express will together operate 48 scheduled and non-scheduled flights on March 19, with operations focused on GCC routes as the airline group continues to manage disruption across parts of the region.

In an update issued on Tuesday, the group said the flights will include scheduled services to Jeddah in Saudi Arabia and Muscat in Oman, alongside additional ad hoc flights to the UAE and Saudi Arabia, subject to slot availability and prevailing operating conditions.

While the airline described the plan as covering the wider West Asia region, the active operations for March 19 are concentrated on GCC markets, particularly the UAE, Saudi Arabia and Oman.

Air India and Air India Express said they will continue scheduled operations to Jeddah and Muscat, including a total of 16 flights between India and Jeddah. Air India will operate one return service each from Delhi and Mumbai, while Air India Express will operate flights from Bengaluru, Hyderabad and Kozhikode.

Air India Express will also operate six scheduled flights to and from Muscat, covering Delhi, Kozhikode and Mumbai.

In addition to the scheduled services, the two carriers will operate 30 non-scheduled flights to and from the UAE and Saudi Arabia. In the UAE, these ad hoc flights will cover Abu Dhabi, Ras Al Khaimah and Sharjah. In Saudi Arabia, additional flights are planned for Riyadh.

The route summary released by the airline group showed no scheduled operations for Dubai, Al Ain, Salalah, Dammam, Bahrain, Doha, Kuwait or Tel Aviv on March 19.

Air India said all of its flights to and from North America, Europe, Australia and other regions will continue to operate as scheduled.

The airline group added that passengers booked on routes where scheduled services remain temporarily suspended can rebook for a future date at no additional charge or opt for a full refund.

Air India Express also said passengers booked to travel from stations in the UAE can rebook onto its additional commercial flights from any UAE station to any destination in India, without extra charges.

The latest update underlines the importance of GCC routes to Indian carriers, particularly at a time when airlines are having to make tactical adjustments to operations across the wider region.

Iran’s Pars gas field was hit on Wednesday in the first reported strikes on Iranian energy infrastructure in the Gulf during the US-Israeli war.

Pars is the Iranian sector of the world’s largest natural gas deposit, which Iran shares with Qatar across the Gulf. Iran’s Fars news agency reported that gas tanks and parts of a refinery had been hit, workers had been evacuated to a safe location and emergency crews were trying to put out a fire.

The attack was widely reported in Israeli media to have been carried out by Israel with the consent of the US. The Israeli military did not immediately respond to requests for comment.

Qatar called it an Israeli attack without mentioning any US role. The Qatari foreign ministry spokesperson called it a “dangerous and irresponsible” escalation that put global energy security at risk.

Iran’s Revolutionary Guards swiftly told Saudi Arabia, the UAE and Qatar to evacuate several energy facilities.

The US and Israel had previously held back from targeting Iran’s energy production facilities in the Gulf, a move that could invite retaliation against other producers and make it harder for global markets to recover from what has already been the biggest ever interruption to energy supplies.

But nearly three weeks into the war, there has been no sign of de-escalation.

This Eid, ANAX Holding, a Dubai-based investment firm, supported the noble initiatives carried out by the Emirates Red Crescent benefiting vulnerable families and individuals across the UAE.

During a visit to the Emirates Red Crescent Dubai Center, Satish Sanpal, founder and chairperson of ANAX Holding, emphasised the significant role of corporate engagement in driving social and humanitarian impact.

“We all have responsibilities toward the society we live in. This Eid, we wanted to reinforce our commitment to social responsibility by supporting the humanitarian work led by the ERC. Their efforts continue to make a meaningful difference in the lives of many people in the UAE and beyond,” said Sanpal.

The visit included discussions with Mohammed Ahmed Al Yamahi, director of the Emirates Red Crescent, Dubai Center, who welcomed the ANAX Holding team and highlighted the importance of collaboration between humanitarian organisations and the private sector in expanding charitable initiatives.

Anax Holding’s contribution supports company’s ethos

“The continued support of partners such as Sanpal and ANAX Holding plays a vital role in helping us expand our humanitarian programmes and reach more people in need,” said Al Yamahi.

The contribution reflects ANAX Holding’s ongoing commitment to supporting impactful charitable efforts that align with the company’s ethos and core values.