GHOSTBLADE
GHOSTBLADE is a JavaScript-based iOS post-exploitation malware family associated with the DarkSword full-chain exploit kit. It is described as a highly aggressive infostealer/dataminer and, in some reporting, as an initial-stage implant used for device profiling and access validation after successful compromise. DarkSword has been observed since at least November 2025 targeting iOS devices running versions 18.4 through 18.7, and successful exploitation can deploy GHOSTBLADE, GHOSTKNIFE, or GHOSTSABER depending on the threat actor and campaign.
High-confidence reporting links GHOSTBLADE to data theft from compromised Apple devices. Reported collection targets include iMessages, Telegram and WhatsApp data, email, calls, contacts, cryptocurrency wallet data, Safari history and cookies, photos, Health databases, device keychains, location history, system and connectivity information, and saved Wi-Fi passwords. Multiple sources also state that DarkSword-delivered malware families, including GHOSTBLADE, exfiltrate data such as iMessages, cryptocurrency wallet data, location history, and saved Wi-Fi passwords. One report notes debugging code in GHOSTBLADE related to Wi-Fi credential targeting and kernel-memory hexdumping.
GHOSTBLADE has been associated with several Russia-linked operations. It is attributed in the content to suspected Russian espionage actor UNC6353, which reportedly used DarkSword in watering-hole campaigns against Ukrainian targets. Proofpoint and Malfors also reported that COLDRIVER/TA446 used the DarkSword kit to deliver GHOSTBLADE in spear-phishing campaigns, including fake Atlantic Council "discussion invitation" emails, targeting government, think tank, higher education, financial, and legal entities. The broader DarkSword ecosystem has also been observed in campaigns affecting targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.
The infection vector for GHOSTBLADE is the DarkSword exploit chain, including watering-hole compromises of legitimate websites and targeted phishing-linked delivery to vulnerable iPhone users. After full compromise, DarkSword drops one of its JavaScript malware families onto the victim device. Analysis cited in the content assesses that GHOSTBLADE was likely developed by the DarkSword developers based on coding-style consistency and tight integration with shared library code.
Known malware-family context and identifiers from the content include the name GHOSTBLADE/GhostBlade and its role as one of three DarkSword payload families alongside GHOSTKNIFE and GHOSTSABER. Reported related infrastructure and campaign artifacts are tied primarily to DarkSword operations rather than uniquely to GHOSTBLADE itself.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Additionally, two vulnerabilities and a multi-component exploit kit were directly connected to active malware campaigns, including a sophisticated iOS full-chain exploit called DarkSword that delivered the GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE payloads... 28 CVE-2026-32183 99 Apple iOS / iPadOS (DarkSword Chain) CWE-119 – Memory Corruption No | Additionally, two vulnerabilities and a multi-component exploit kit were directly connected to active malware campaigns, including a sophisticated iOS full-chain exploit called DarkSword that delivered the GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE payloads.
CVE-2025-43520 (CVSS score: 8.8) - A memory corruption vulnerability in Apple's kernel component that could allow a malicious application to cause unexpected system termination or write kernel memory. (Fixed in December 2025) | ...an iOS exploit kit codenamed DarkSword that leverages these shortcomings, along with three bugs, to deploy various malware families like GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER for data theft.
...an iOS exploit kit codenamed DarkSword that leverages these shortcomings, along with three bugs, to deploy various malware families like GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER for data theft. | CVE-2025-43510 (CVSS score: 7.8) - A memory corruption vulnerability in Apple's kernel component that could allow a malicious application to cause unexpected changes in memory shared between processes. (Fixed in December 2025)
CVE-2025-31277 (CVSS score: 8.8) - A vulnerability in Apple WebKit that could result in memory corruption when processing maliciously crafted web content. (Fixed in July 2025) | ...an iOS exploit kit codenamed DarkSword that leverages these shortcomings, along with three bugs, to deploy various malware families like GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER for data theft.
DarkSword is an exploit kit that targets iPhones running iOS versions 18.4 through 18.7... The kit leverages six vulnerabilities, CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.
DarkSword is an exploit kit that targets iPhones running iOS versions 18.4 through 18.7... The kit leverages six vulnerabilities, CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.
DarkSword is an exploit kit that targets iPhones running iOS versions 18.4 through 18.7... The kit leverages six vulnerabilities, CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Depending on the threat actor, a successful compromise deployed distinct malware families we track as GHOSTBLADE, GHOSTKNIFE, or GHOSTSABER.
Depending on the threat actor, a successful compromise deployed distinct malware families we track as GHOSTBLADE, GHOSTKNIFE, or GHOSTSABER.
Depending on the threat actor, a successful compromise deployed distinct malware families we track as GHOSTBLADE, GHOSTKNIFE, or GHOSTSABER.
Proofpoint and Malfors also revealed that another Russia-linked threat actor known as COLDRIVER (aka TA446) has exploited the DarkSword kit to deliver the GHOSTBLADE data stealer malware in attacks targeting government, think tank, higher education, financial, and legal entities.
Artifacts left behind from the Webpack process applied to the analyzed GHOSTBLADE sample included file paths that show the structure on disk of these libraries (Figure 22). We assess that GHOSTBLADE was likely developed by the DarkSword developers, based on the consistency in coding styles and the tight integration between it and the library code, which is notably distinct from how GHOSTKNIFE and GHOSTSABER leveraged these libraries.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques...a sophisticated iOS full-chain exploit called DarkSword that delivered the GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE payloads.
By chaining together six different zero-day vulnerabilities, these actors were able to fully compromise devices running iOS 18.4 through 18.7.
The hacking group is known for spear-phishing campaigns aimed at harvesting credentials from targets of interest. The latest activity involves using fake "discussion invitation" emails spoofing the Atlantic Council...
Execution
2 techniquesResearchers have observed three malware families associated with DarkSword attacks. These include GhostBlade, an aggressive JavaScript-based infostealer; GhostKnife, a backdoor; and GhostSaber, a JavaScript malware capable of executing code and stealing data.
CVE-2025-31277 ... A vulnerability in Apple WebKit that could result in memory corruption when processing maliciously crafted web content.
Privilege Escalation
2 techniquesDarkSword targets iOS 18.4–18.7, leveraging six vulnerabilities to achieve: Remote Code Execution (RCE) Sandbox Escape Kernel-Level Privilege Escalation
DarkSword targets iOS 18.4–18.7, leveraging six vulnerabilities to achieve: Remote Code Execution (RCE) Sandbox Escape Kernel-Level Privilege Escalation
Stealth
1 techniqueIt collects data quickly (within seconds to minutes) before removing itself from the target device.
Discovery
1 techniquefunctions as a comprehensive data miner exfiltrating iMessages, Telegram, and WhatsApp data, cryptocurrency wallet data
Collection
3 techniquesResearchers have observed three malware families associated with DarkSword attacks. These include GhostBlade, an aggressive JavaScript-based infostealer; GhostKnife, a backdoor; and GhostSaber, a JavaScript malware capable of executing code and stealing data.
The orchestrator injects a JavaScript engine into privileged iOS services such as App Access, Wi‑Fi, Springboard, Keychain, and iCloud, and then activates data-stealing modules... Browser history, Cookies
The latest activity... facilitate[s] the delivery of GHOSTBLADE, a dataminer malware... It's suspected that the TA446 is repurposing the DarkSword exploit kit for credential harvesting and intelligence collection.
Exfiltration
1 techniqueThese act as dataminers and backdoors, exfiltrating iMessages, cryptocurrency wallet data, location history, and saved WiFi passwords.
IOCs tracked for this family
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A final-stage malware family deployed after successful exploitation via DarkSword on iOS devices.
A payload delivered by the DarkSword iOS full-chain exploit in an active malware campaign.
A data stealer malware delivered via the DarkSword exploit kit in attacks attributed to COLDRIVER, used to steal user data from targeted organizations.
A JavaScript-based infostealer used in attacks associated with the DarkSword exploit kit.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.