Darksword
DarkSword is a fully weaponized iOS exploit kit and spyware delivery framework targeting Apple iPhone and iPad devices, especially iOS/iPadOS 18.4 through 18.7. It was publicly documented by Google Threat Intelligence Group (GTIG), iVerify, and Lookout, with activity observed from at least November 2025 and reporting indicating attacks since July 2025. The exploit chain is described as a sophisticated full-chain, likely government-designed capability that uses six vulnerabilities, including flaws in JavaScriptCore, dyld, and the iOS sandbox, to achieve silent compromise and kernel-level code execution after a victim visits a malicious or compromised website. DarkSword has been used in watering-hole attacks on legitimate compromised sites, including Ukrainian websites, and requires little to no user interaction beyond loading the page.
Post-compromise, DarkSword has been associated with delivery of the GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER payloads. Reported capabilities include installing spyware or backdoors, information theft, credential harvesting, PAC/proxy bypass, remote code execution, and collection of messages, passwords, browser history, photos, notes, emails, location data, Apple Health data, and cryptocurrency wallet data. Some reporting also states it can remove traces of compromise after data theft. Researchers linked DarkSword activity to campaigns targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine.
The kit has been observed in use by multiple actors, including commercial surveillance vendors, suspected state-sponsored actors, Russian-linked operators, Saudi-aligned and Turkish surveillance vendors, and criminal users after a version leaked publicly on GitHub in March 2026. UNC6353 was reported to have incorporated DarkSword into watering-hole campaigns, and TA446/COLDRIVER/SEABORGIUM/Star Blizzard was observed using DarkSword in targeted phishing campaigns, including Atlantic Council-themed lures, to target iOS users for credential harvesting and intelligence collection. Proofpoint-linked reporting described DarkSword components including a redirector, exploit loader, remote code execution module, and PAC bypass module. Known infrastructure and indicators mentioned in the content include the MD5 hash 5fa967dbef026679212f1a6ffa68d575 for a DarkSword loader, and domains motorbeylimited[.]com, bridetvstreaming[.]org, and escofiringbijou[.]com associated with TA446-linked DarkSword activity.
Apple issued unusual backported protections, including iOS 18.7.7 and iPadOS 18.7.7, specifically to defend users remaining on older iOS 18 releases, and also referenced DarkSword in security notes as a web attack. Lockdown Mode was cited as providing protection for high-risk users.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
20 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Additionally, two vulnerabilities and a multi-component exploit kit were directly connected to active malware campaigns, including a sophisticated iOS full-chain exploit called DarkSword that delivered the GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE payloads.
The addition of the three Apple vulnerabilities to the KEV catalog comes in the wake of reports from Google Threat Intelligence Group (GTIG), iVerify, and Lookout about an iOS exploit kit codenamed DarkSword that leverages these shortcomings, along with three bugs, to deploy various malware families like GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER for data theft.
The addition of the three Apple vulnerabilities to the KEV catalog comes in the wake of reports from Google Threat Intelligence Group (GTIG), iVerify, and Lookout about an iOS exploit kit codenamed DarkSword that leverages these shortcomings, along with three bugs, to deploy various malware families like GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER for data theft.
The addition of the three Apple vulnerabilities to the KEV catalog comes in the wake of reports from Google Threat Intelligence Group (GTIG), iVerify, and Lookout about an iOS exploit kit codenamed DarkSword that leverages these shortcomings, along with three bugs, to deploy various malware families like GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER for data theft.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
what makes DarkSword remarkable isn’t just that it works. It’s how it systematically defeats every layer of defense Apple built. | CVE-2026–20700, a vulnerability in dyld (the dynamic linker), let DarkSword bypass that too.
what makes DarkSword remarkable isn’t just that it works. It’s how it systematically defeats every layer of defense Apple built.
what makes DarkSword remarkable isn’t just that it works. It’s how it systematically defeats every layer of defense Apple built.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In mid-March, when three cybersecurity firms — iVerify, Lookout, and Google’s Threat Intelligence Group — published coordinated findings about an exploit kit they named DarkSword. Researchers found it sitting openly on compromised Ukrainian websites... Any visitor on an unpatched iPhone running iOS 18.4 through 18.6.2 would have been silently compromised the moment the page loaded.
DarkSword is a sophisticated piece of malware—probably government designed—that targets iOS. Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices.
Apple has patched the vulnerabilities associated with the DarkSword exploit chain for all affected customers... DarkSword leaked to GitHub on March 22... We’ve observed a handful of campaigns being conducted with the malware, to include [an] email phishing campaign conducted by TA446 which spoofed the Atlantic Council.
A major new cybersecurity threat has emerged for iPhone users worldwide, as researchers have uncovered a new hacking tool called DarkSword. According to a joint investigation by Google, Lookout, and iVerify, hundreds of millions of people could be at risk if they have not updated their software recently.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
5 techniquesThe attack framework used a “watering hole” technique, stealthily targeting visitors who loaded infected pages. Researchers said vulnerable iPhones could be compromised simply by visiting a hacked website.
Commercial spyware, often developed by private firms, exploits software vulnerabilities to gain access.
We’ve observed a handful of campaigns being conducted with the malware, to include [an] email phishing campaign conducted by TA446 which spoofed the Atlantic Council.
“If you’re using an older version of iOS and were to click a malicious link... the data on your iPhone might be at risk of being stolen,” Apple warned.
...an email phishing campaign conducted by TA446 which spoofed the Atlantic Council.
Execution
2 techniquesOnce launched, the attacks have been found to deploy backdoors and a dataminer for persistent access and information theft.
This all concerns DarkSword, a deeply scary exploit... If you’re an iPhone user with an unpatched older version of iOS, just browsing an infected site can install spyware on your device...
Privilege Escalation
1 techniqueDarkSword supports iOS versions 18.4 through 18.7 and utilizes six different vulnerabilities to deploy final-stage payloads.
Stealth
1 techniqueOnce deployed, DarkSword exfiltrates passwords, messages, browser history, location data, cryptocurrency wallet contents, and even Apple Health data within seconds before wiping its own traces.
Credential Access
1 techniqueLes attaquants peuvent alors contrôler votre appareil infecté... récupérer les mots de passe enregistrés
Collection
2 techniquesOnce active, DarkSword could access a wide range of information, including messages, passwords, browser history, photos, notes, emails, and cryptocurrency wallet data.
commercial spyware capable of infiltrating computers and phones to extract sensitive data
Exfiltration
1 techniqueThey infect devices when the user simply visits a compromised legitimate site, use a chain of vulnerabilities to escape the browser sandbox, and silently exfiltrate messages, calls, location, browser history, Wi-Fi passwords, health data, notes and crypto wallets.
IOCs tracked for this family
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An iPhone exploit kit used in watering-hole attacks via compromised websites. It could silently compromise vulnerable iPhones upon page load and access messages, passwords, browser history, photos, notes, emails, and cryptocurrency wallet data.
Recently leaked exploit kit referenced as part of public exploit chains against modern iOS.
An iOS full-chain exploit used to fully compromise iPhones/iOS devices via multiple zero-day vulnerabilities and deploy final-stage surveillance payloads. It has been used by commercial surveillance vendors and suspected state-sponsored actors in distinct campaigns.
An iOS spyware exploit chain delivered through watering-hole compromises of legitimate sites, enabling silent compromise and exfiltration of sensitive mobile data; described as fileless and not surviving reboot.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.