Tech
Russians caught stealing personal data from Ukrainians with new advanced iPhone hacking tools
A group of hackers suspected of working at least in part for the Russian government targeted iPhone users in Ukraine with a new set of hacking tools designed to steal their personal data, as well as potentially steal cryptocurrency, according to cybersecurity researchers.
Researchers at Google and security firms iVerify and Lookout analyzed new cyberattacks against Ukrainians which were launched by a group identified only as UNC6353. The researchers looked at compromised websites in a hacking campaign that, they say, is related to one uncovered earlier this month. This most recent campaign used a hacking toolkit the companies called Darksword.
The discovery of Darksword, which follows that of a similar hacking toolkit, suggests that advanced, stealthy, and powerful spyware for iPhones may not be as rare as previously thought. Even then, Darksword only targeted users in Ukraine, implying some restraint in what could have otherwise been a widescale hacking campaign targeting users worldwide.
In early March, Google revealed details of a sophisticated iPhone-hacking toolkit called Coruna. The search giant said that the tool was used first by a government customer of a surveillance tech vendor, then by Russian spies targeting Ukrainians, and finally Chinese cybercriminals looking to steal cryptocurrency. As TechCrunch later revealed, the hacking toolkit was originally developed at U.S. defense contractor L3Harris, in particular by its hacking and surveillance tech department Trenchant.
Coruna was originally designed for use by Western governments, in particular those part of the so-called Five Eyes intelligence alliance, consisting of Australia, Canada, New Zealand, the United States, and the United Kingdom, according to former L3Harris employees with knowledge of the company’s iPhone hacking tools.
Now, researchers said they uncovered a related campaign using more recent hacking tools exploiting different vulnerabilities.
The Darksword toolkit, according to the researchers, was built to steal personal information such as passwords; photos; WhatsApp, Telegram, and text messages; and browser history. Interestingly, Darksword was not designed for persistent surveillance, but rather to infect victims, steal information, and quickly disappear.
Contact Us
Do you have more information about Darksword, Coruna, or other government hacking and spyware tools? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or by email.
Darksword’s “dwell time on the device is likely in the range of minutes, depending on the amount of data it discovers and exfiltrates,” Lookout researchers wrote.
For Rocky Cole, the co-founder of iVerify, the most likely explanation is that the hackers were interested in learning about the victims’ pattern of life, which didn’t require them to do constant surveillance, but rather a smash-and-grab operation.
Darksword was also designed to steal cryptocurrency from popular wallet apps, something that is unusual for a suspected government hacking group.
“This may indicate that this threat actor is financially motivated, or alternatively it may indicate that this (likely) Russian state-aligned activity has expanded into financial theft targeting mobile devices,” Lookout wrote in its report.
But, Cole told TechCrunch, there is no evidence that the Russian hacking group actually cared about stealing crypto, only that the malware could have been used for that.
The malware was professionally developed to be modular and to make it easy to add new functionality, something that shows it was professionally designed, according to Lookout. Cole said he believes it’s possible that the same person who sold Coruna to the Russian government hacking group also sold Darksword.
In terms of who was behind Darksword, for Cole “all signs point to the Russian government,” while Lookout said it’s the same group that used Coruna against Ukrainians, also a suspected Russian government group.
“UNC6353 is a well-funded and connected threat actor conducting attacks for financial gain and espionage in alignment with Russian intelligence requirements,” Justin Albrecht, principal security researcher at Lookout, told TechCrunch. “We believe that a case can be made that UNC6363 is potentially a Russian criminal proxy, given the dual goals of financial theft and intelligence collection.”
As for victims, Cole said that the malware was designed to infect anyone visiting certain Ukrainian websites, as long as they were visiting them from within Ukraine, so it wasn’t a particularly targeted campaign.
Tech
ElevenLabs lists BlackRock, Jamie Foxx, and Eva Longoria as new investors
Voice AI company ElevenLabs revealed new investors that are part of its $500 million Series D fundraise, which was first announced in February. The additions include institutions such as BlackRock, Wellington, D.E. Shaw, and Schroders; enterprises like Nvidia, Salesforce Ventures, Santander, KPN, and Deutsche Telekom; and individual investors such as Jamie Foxx, Eva Longoria, and Squid Game creator Hwang Dong-hyuk.
The startup also noted that it surpassed $500 million in ARR (annual recurring revenue), after ending last year with nearly $350 million in ARR. The company’s co-founder and CEO, Mati Staniszewski, said last month that ElevenLabs added $100 million in net new ARR in Q1 2026, ending the quarter at roughly $450 million in ARR.
The company has also accelerated its valuation rapidly, growing from $6.6 billion last September to $11 billion this February.
“Voice is the highest-stakes channel for any customer interaction, and the bar for quality, latency, and security is extremely high. ElevenLabs is not just a category leader – it is becoming a foundational enabler of Deutsche Telekom’s broader Industrial AI vision. From voice-as-a-service to multilingual automation and in-network AI agents, we believe the company is uniquely positioned to reshape how businesses interact with customers across all channels,” Karine Peters, managing director at Deutsche Telekom’s venture arm T.Capital, said in a statement.
In the past quarter, the voice AI company has signed enterprise contracts with the likes of Deutsche Telekom, Revolut, and Klarna.
ElevenLabs said that, besides the fundraising, it also closed a $100 million tender, a second in roughly six months after the company issued one last September. Staniszewski said in a blog post that the company will give an opportunity to retail investors to invest in ElevenLabs through Robinhood Ventures, but didn’t provide details about the program.
Staniszewski noted that consumers won’t trust systems that sound robotic or “interact strangely” and emphasized the importance of building “human-level AI voice models.” Last month, the company acquired the team from Polish voice AI startup Papla to bolster its research team.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
Kaspersky suspects Chinese hackers planted a backdoor into Daemon Tools in ‘widespread’ attack
Security researchers at Kaspersky say they have identified a malicious backdoor planted in the popular and long-running Windows disc imaging software, Daemon Tools.
The Russian cybersecurity company said on Tuesday that data collected from computers around the world running the Kaspersky antivirus software shows a “widespread” attack is under way, targeting thousands of Windows computers running Daemon Tools.
The hackers, whom Kaspersky has linked to a Chinese-language speaking group based on an analysis of the malware, used the backdoor in Daemon Tools to plant additional malware on a dozen computers across the retail, scientific and manufacturing sectors, as well as government systems. Kaspersky said the hacking of these specific computers implied a “targeted” effort.
The company said the targeted organizations are located in Russia, Belarus, and Thailand.
Kaspersky said the backdoor was first detected on April 8.
Kaspersky said it had contacted Disc Soft, the company that maintains Daemon Tools, but did not say if the developer responded or took action. Kaspersky said the supply chain attack is “still active,” suggesting that the hackers can still plant malware on thousands of computers running the disc imaging software.
This is the latest in a string of so-called “supply chain” attacks that have targeted developers of popular software in recent months. Hackers are increasingly taking aim at the accounts of developers who work on widely used code and software, and abusing that access to push malicious code to anyone who relies on the software. This approach lets the hackers break into a large number of computers at once when their malicious code is delivered as a software update.
Earlier this year, hackers associated with the Chinese government hijacked the popular text editing software Notepad++ to deliver malware to a number of organizations with interests in East Asia. Security researchers also warned of another attack last month targeting users who visited the website of CPUID, which makes the popular HWMonitor and CPU-Z tools.
TechCrunch downloaded the Windows installer from Daemon Tools’ website, and the file appeared to contain the backdoor when we checked it with the online malware scanner service VirusTotal.
It’s not known if the macOS version of Daemon Tools was compromised, or if other apps made by Disc Soft are affected.
When contacted for comment, a Disc Soft representative said they are “aware of the report and are currently investigating the situation.”
“Our team is treating this matter with the highest priority and is actively working to assess and address the issue. At this stage, we are not in a position to confirm specific details referenced in the report. However, we are taking all necessary steps to remediate any potential risks and to ensure the security of our users,” the representative said.
Do you know more about the cyberattack targeting Daemon Tools users? Did you receive an antivirus alert saying you were affected? We want to hear from you. To contact this reporter securely, reach out via Signal username zackwhittaker.1337.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
Etsy launches its app within ChatGPT as it continues its AI push
Etsy announced Tuesday the launch of its native app within ChatGPT, opening up a new way for shoppers to explore its catalog of over 100 million listings.
The new experience is designed to move beyond the limitations of traditional keyword queries. Instead of typing something like “wooden coffee table,” then scrolling and adjusting filters, users can now express what they’re looking for in natural language. For instance, “Help me find a Mother’s Day gift under $100 for my mom who loves gardening.”
Now live in beta, the feature allows users to tag @Etsy directly within a prompt. From there, the Etsy app in ChatGPT surfaces relevant product listings that users can browse, compare, and click through to Etsy for additional details or purchase.
This isn’t Etsy’s first experiment inside ChatGPT. Back in September, Etsy became an early partner in ChatGPT’s Instant Checkout integration, which let users buy products directly inside the chat interface. However, the initiative ended in March, suggesting it didn’t perform as OpenAI had hoped. It was reported that Etsy didn’t see a large volume of sales from the integration, leading Etsy to start building a native app within ChatGPT instead.
Alongside this launch, Etsy also revealed it’s testing a beta conversational search experience within its platform, specifically geared toward helping users find gifts. The gift assistant acts as a personal shopper, offering a guided, conversational way to discover ideas, narrow down preferences, and surface relevant products.
This builds on Etsy’s broader AI push, which includes an AI-powered discovery experience featuring curated collections and a suite of seller tools, including a tool that helps generate product titles and descriptions, as well as a writing assistant to help draft messages to buyers. In 2024, Etsy introduced a new “Designed” label to identify AI content, part of an effort to increase transparency as AI-generated artwork becomes more prevalent on the platform.
The news of a ChatGPT integration comes a week after Etsy reported its Q1 2026 earnings, surpassing revenue expectations with $631 million, and marketplace gross merchandise sales were up 6% year over year. Notably, active buyers increased for the first time in two years to 86.6 million. Etsy also touted 5.6 million active sellers on the platform.
In February, the company announced it was selling Depop to eBay for $1.2 billion in cash, a move aimed at doubling down on its core marketplace.
Etsy joins a growing list of companies building native apps within ChatGPT, including Angi, SeatGeek, Tubi, and Wix. Developers have been able to build apps within the chatbot since October.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Pennsylvania is suing Character.AI for allegedly practicing medicine without a license
How to watch Bayern Munich vs. PSG online for free
