Last seven days
- First activity
- Sep 7, 2026
- Last activity
- Sep 7, 2026
- Feed role
- Distribution
- Host form
- 0 IP / 1 hostnames
Darksword
DarkSword is a publicly leaked, full-chain iOS exploit kit and spyware framework targeting unpatched iPhone and iPad devices, principally iOS and iPadOS 18.4 through 18.7.
Profile source: Mallory opens in a new tabDarksword
Family profile
DarkSword is a publicly leaked, full-chain iOS exploit kit and spyware framework targeting unpatched iPhone and iPad devices, principally iOS and iPadOS 18.4 through 18.7. It chains six vulnerabilities—including WebKit/JavaScriptCore, sandbox-escape, pointer-authentication bypass, and kernel flaws—to obtain remote code execution, escape application sandboxes, and gain elevated kernel-level access. It is delivered through compromised websites, watering holes, impersonated sign-in pages, and other lure pages that silently stage version-specific browser exploits in hidden content.
Following successful exploitation, DarkSword deploys post-exploitation components, including GHOSTBLADE modules, to collect Keychain material, saved Wi-Fi credentials, iCloud data, files, messages, contacts, photographs, browser data, call and location history, and application data. Some observed deployments target cryptocurrency-wallet credentials, seed phrases, and mnemonics. DarkSword can monitor keyboard input when targeted wallet applications are active, encrypt and exfiltrate collected data to operator-controlled infrastructure, inject into iOS system processes, and remove diagnostic artifacts or delete itself to hinder forensic detection.
DarkSword activity has been observed since at least November 2025 in campaigns targeting victims in Saudi Arabia, Turkey, Malaysia, and Ukraine. It was initially associated with commercial surveillance vendors and suspected state-sponsored operators; public leakage subsequently enabled adoption by multiple additional operators, including criminal users. The exploit chain relies on vulnerabilities for which Apple has issued security fixes, making updated Apple devices protected against the documented exploit stages.
Capabilities
- Credential Theft
- Defense Evasion
- Exfiltration
- Initial Access
- Keylogging
- Post Exploitation
- Privilege Escalation
- Process Injection
- Spoofing
Observed infrastructure
Leading locations
- US1
Leading providers
- Cloudflare, Inc.1
Infrastructure traits
- Anycast 1
- Hosting 1
Reported operators
Threat actors
5 named in public reportingThe renderer CVEs and the staging pattern overlap with the publicly documented “DarkSword” iOS exploit kit.
DarkSword, discovered and detailed earlier this year by Google Threat Intelligence Group (GTIG), iVerify, and Lookout, refers to a full-chain exploit kit that is believed to have been used by commercial surveillance vendors and suspected state-sponsored actors in disparate campaigns targeting Saudi Arabia, Turkey, Malaysia, and Ukraine since at least November 2025.
In mid-March, when three cybersecurity firms — iVerify, Lookout, and Google’s Threat Intelligence Group — published coordinated findings about an exploit kit they named DarkSword. Researchers found it sitting openly on compromised Ukrainian websites... Any visitor on an unpatched iPhone running iOS 18.4 through 18.6.2 would have been silently compromised the moment the page loaded.
Apple has patched the vulnerabilities associated with the DarkSword exploit chain for all affected customers... DarkSword leaked to GitHub on March 22... We’ve observed a handful of campaigns being conducted with the malware, to include [an] email phishing campaign conducted by TA446 which spoofed the Atlantic Council.
A major new cybersecurity threat has emerged for iPhone users worldwide, as researchers have uncovered a new hacking tool called DarkSword. According to a joint investigation by Google, Lookout, and iVerify, hundreds of millions of people could be at risk if they have not updated their software recently.
Exploited software
Vulnerabilities linked to Darksword
20 CVEs CVE-2025-31277 Apple WebKit Memory Corruption via Malicious Web Content CVE-2025-14174 ANGLE Out-of-Bounds Memory Access in Google Chrome for Mac CVE-2025-43529 WebKit Use-After-Free Remote Code Execution CVE-2025-43520 Apple XNU VFS Kernel Race Condition Memory Corruption CVE-2025-43510 Apple XNU Improper Locking Memory Corruption CVE-2026-20700 dyld Memory Corruption and User-Mode PAC Bypass CVE-2026-32183 Command Injection in Windows Snipping Tool CVE-2025-14524 curl OAuth2 Bearer Token Cross-Protocol Redirect Disclosure CVE-2026-20643 Same Origin Policy Bypass in WebKit Navigation API CVE-2026-20687 Use-After-Free in Apple Kernel CVE-2026-28868 Kernel memory disclosure in Apple operating systems CVE-2025-43534 Activation Lock bypass in iOS and iPadOS iTunes Store path handling CVE-2026-20690 Out-of-bounds access in Apple CoreMedia audio stream processing CVE-2026-28864 Keychain access permissions flaw in Apple Security Framework CVE-2026-28861 Cross-origin script message handler access in WebKit CVE-2026-28867 Sensitive kernel state disclosure in Apple Kernel CVE-2026-28865 Authentication flaw in Apple 802.1X allowing network traffic interception CVE-2026-20665 Content Security Policy Bypass in WebKit CVE-2026-28871 Cross-Site Scripting in WebKit CVE-2026-20637 Use-After-Free in AppleKeyStore
MITRE ATT&CK
Darksword in ATT&CK
45 distinct techniquesTechniques
45 techniques T1027 Obfuscated Files or Information T1055 Process Injection T1041 Exfiltration Over C2 Channel T1059.007 JavaScript T1005 Data from Local System T1056.001 Keylogging T1189 Drive-by Compromise T1203 Exploitation for Client Execution T1105 Ingress Tool Transfer T1555 Credentials from Password Stores T1070.004 File Deletion T1083 File and Directory Discovery T1497.001 System Checks T1068 Exploitation for Privilege Escalation T1573 Encrypted Channel T1528 Steal Application Access Token T1611 Escape to Host T1649 Steal or Forge Authentication Certificates T1497 Virtualization/Sandbox Evasion T1622 Debugger Evasion T1070 Indicator Removal T1056 Input Capture T1211 Exploitation for Defense Evasion T1566 Phishing T1564.003 Hidden Window T1082 System Information Discovery T1566.002 Spearphishing Link T1036.005 Match Legitimate Resource Name or Location T1071.001 Web Protocols T1583.003 Virtual Private Server T1056.003 Web Portal Capture T1071 Application Layer Protocol T1190 Exploit Public-Facing Application T1213 Data from Information Repositories T1566.003 Spearphishing via Service T1059 Command and Scripting Interpreter T1598 Phishing for Information T1090 Proxy T1212 Exploitation for Credential Access T1557 Adversary-in-the-Middle T1620 Reflective Code Loading T1204.001 Malicious Link T1592 Gather Victim Host Information T1027.011 Fileless Storage T1543 Create or Modify System Process
Reporting
Research mentioning Darksword
Aug 31
Socket
13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds | Socket
Thirteen trojanized Composer theme packages for the OphimCMS and KKPhim streaming-site ecosystems injected malicious JavaScript into every visitor page, sending users to gambling and ad-fraud content and selectively attacking externally referred, non-desktop visitors. On vulnerable iPhones, the packages delivered a FUNNULL-hosted WebKit-to-kernel exploit chain targeting CVE-2025-31277, CVE-2025-43529, and an AppleM2ScalerCSCDriver kernel primitive; the campaign targeted iOS 18.4 through 18.6.x rather than updated versions. The spyware harvested keychain data, messages, photos, browser cookies, location history, and cryptocurrency wallet seed phrases, then exfiltrated them to rotating command-and-control infrastructure. Operators redeployed the exploit chain and added wallet theft capabilities, while FUNNULL-linked infrastructure has continued operating after sanctions, with activity reportedly being separated from the FUNNULL CDN brand.
Apr 14
Silentpush
