Loading malware…
DarkSword is an iOS exploit kit used to compromise vulnerable iPhones through malicious or compromised websites. Observed in attacks since at least November 2025 and publicly documented in March 2026, its established exploit chain targets iOS 18.4 through 18.7. It combines six vulnerabilities affecting JavaScriptCore, dyld, ANGLE, and the iOS kernel to achieve browser code execution, sandbox escape, kernel privileges, and payload injection into system processes such as SpringBoard. Apple has patched the vulnerabilities used by the established chain.
Delivery commonly involves watering-hole compromises, hidden web frames, and device-specific exploit selection. Campaigns have used compromised Ukrainian news and government websites, fake sign-in pages, Apple-themed promotions, and invitation lures. Visiting an exploit-bearing page in Safari can initiate compromise without requiring an application installation or further interaction.
DarkSword deploys information-stealing payloads including GHOSTBLADE. These can collect Keychain credentials, saved Wi-Fi passwords, iCloud information, messages, contacts, call histories, photographs, notes, and application files. Early operations emphasize rapid collection and exfiltration followed by removal of diagnostic traces rather than durable access. The P7 DarkSword variant adds bidirectional command-and-control, operating-system command execution, arbitrary JavaScript execution, application enumeration, filesystem reconnaissance, selective file collection, and cryptocurrency-wallet data extraction. Modified deployments also include keyboard-input collection from targeted wallet applications. Combined DarkSword–Coruna deployments use DarkSword for device compromise and Coruna modules for cryptocurrency-wallet harvesting.
Multiple operators have used DarkSword against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. Documented users include the Turkish surveillance vendor PARS Defense and UNC6353, which targeted Ukrainian users. Ukrainian targeting includes military personnel and government officials. Public leakage of the kit facilitated broader adoption and modification by additional operators, including financially motivated groups conducting cryptocurrency theft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
22 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
An analysis of the production server's exploit registry has revealed that the DarkSword exploit kit comprises two CVE identifiers not previously documented - CVE-2025-24201 ... an out-of-bounds write vulnerability in the WebKit engine that could allow an attacker to break out of the Web Content sandbox. | Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.
CVE-2025-31200 ... a memory corruption vulnerability in the Core Audio framework that allows code execution when processing an audio stream in a maliciously crafted media file (Fixed in iOS 18.4.1 and iPadOS 18.4.1). | Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
Additionally, two vulnerabilities and a multi-component exploit kit were directly connected to active malware campaigns, including a sophisticated iOS full-chain exploit called DarkSword that delivered the GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE payloads.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.
“DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026.”
“DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026.”
En mars 2026, ProofPoint a signalé le déploiement du backdoor DarkSword sur des appareils Apple iOS vulnérables.
Victims were served ClickFix-style lures to deliver Windows, Android, and iOS malware tailored to their device; DarkSword was the listed iOS malware.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
“During watering-hole attacks, the attackers compromised legitimate websites visited by the intended targets and modified them in order to deliver the attack.”
The loader consists of a 1,025-item string array, array shifting, and custom Base64 and RC4 applied to each string.
La page frauduleuse imite fidèlement le design d’Apple (logo, pied de page “Copyright © 2026 Apple Inc.”).
app.js coordinates obtaining three plugins and injecting them into SpringBoard (sync.js), securityd (auth.js), and kbd (input.js) via InjectJS.
“[DarkSword is] capable of extracting sensitive information within minutes and then erasing traces of the compromised device.”
“An invisible frame checks the visitor’s iOS version and selects the next code to load.” The first server message includes “a device identifier, device information, and status.”
“Its commands can list directories, retrieve files and full-size photos.”
187 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
77 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An iOS exploit kit that chains vulnerabilities to escape the browser sandbox, obtain kernel privileges, and inject an implant into SpringBoard. Detected in the wild in November 2025 and publicly documented in March 2026, it has been used against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. The P7 variant reduces logging, prevents repeat exploitation through browser localStorage, and extracts keychain data into JSON on-device before exfiltration. Its two-way C2 supports command polling, arbitrary operating-system commands and JavaScript execution, filesystem reconnaissance, and theft of application data, notes, photos, and cryptocurrency-wallet information.
An iOS exploitation platform that attacks WebKit and JavaScriptCore, escapes the browser sandbox, and obtains kernel access to deliver wallet-theft implants. Exposed infrastructure included device registration, implant commands, agent accounts, commissions, and device quotas. Development files referenced an unfinished iOS 26 exploit; the content does not establish its deployment.
Commercial iOS exploitation toolkit that attacks WebKit and JavaScriptCore, escapes the browser sandbox, obtains kernel privileges, and enables injection into SpringBoard. Operators combine it with Coruna for cryptocurrency theft. The report exposes active delivery infrastructure and a reseller-based operation. Its registry lists CVE-2025-24201 as an alternative sandbox escape. CVE-2025-31200 is only an unverified zero-click capability claim, while CVE-2026-31001 appears in unfinished, undeployed iOS 26 development modules; neither is established as an operational exploitation capability.
An iPhone-focused exploit kit used in watering-hole attacks against compromised Ukrainian websites. Following device compromise, it collects credentials, messages, contacts, and call histories, then is designed to rapidly erase traces of its activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.