Loading story…
8kSec published a technical case study examining how browser exploits work through CVE-2025-43529, a vulnerability associated with the DarkSword iOS exploit chain. The case study focuses on browser exploitation on Apple’s mobile platform; the supplied information does not establish affected versions, exploitation prerequisites, patch status, or confirmed victim impact.
Apple’s Platform Security documentation describes a hardware-rooted, layered security model that combines system security, encryption, application protections, and service security across its operating systems. Those protections cover startup, software updates, malware prevention, and data protection, providing the defensive context for examining an iOS exploit chain. Security teams should verify Apple’s vulnerability-specific advisories and device update status before determining exposure to CVE-2025-43529; the general platform overview does not establish whether a particular device is protected against DarkSword.
See affected versions and whether adversaries are exploiting it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from **Google**, **iVerify**, and **Lookout** disclosed **DarkSword**, a sophisticated iPhone exploit chain used in compromised websites to silently infect visitors, with observed targeting focused on **Ukraine** and additional activity tied to **Saudi Arabia, Turkey, and Malaysia**. The campaign is linked to suspected Russian operators, including activity tracked as **UNC6353**, and appears to support both **espionage** and **financial theft**, including the theft of saved passwords, text messages, and cryptocurrency wallet data. Reporting also indicates DarkSword is the second major iOS exploit kit recently found in the wild after **Coruna**, reinforcing concerns that advanced mobile exploitation is becoming more broadly operationalized rather than reserved for narrowly targeted, bespoke use. Technical analysis shows DarkSword used multiple chained vulnerabilities to achieve full device compromise on older iOS versions, including JavaScriptCore bugs **`CVE-2025-31277`** and **`CVE-2025-43529`** for remote code execution, **`CVE-2026-20700`** as a `dyld` PAC bypass, and sandbox escapes that pivoted from **WebContent** to the **GPU process** and then to `mediaplaybackd`. The exploit chain relied on first compromising **WebKit** and then abusing **WebGPU/ANGLE**-related paths to escape Safari’s sandbox, and Apple patched the flaws across later iOS releases including **18.6**, **18.7.3**, **26.2**, and **26.3**. Researchers warned that a substantial installed base of devices running **iOS 18 or earlier** remained exposed at the time of disclosure, making DarkSword notable both for its technical sophistication and for the scale of potentially vulnerable iPhones.
Sep 4, 2026
Security researchers and media reports say the **DarkSword** iOS exploitation tool has moved from a targeted threat to a broader operational risk, with evidence that attackers can compromise hundreds of millions of iPhones and that exploit code has leaked publicly. Reporting from WIRED, Lookout, iVerify, and AppleInsider describes DarkSword as a powerful **zero-click** attack capability seen in the wild, raising concern that well-resourced espionage-style techniques are becoming more accessible to additional threat actors. Apple responded by issuing and then expanding protections, including rare **backported patches** for older supported devices to shield users who had not yet moved to newer iOS releases. iVerify said its investigations uncovered signs of zero-click mobile exploitation in the United States and warned that mass iOS attacks now represent a serious enterprise risk, while public reporting stressed that organizations and consumers should update affected iPhones immediately as leaked exploit code increases the likelihood of wider abuse.
Jun 29, 2026
Hungary's National Cybersecurity Institute warned that **DarkSword**, a publicly available spyware and exploit kit for Apple devices, is targeting iPhones and iPads running `iOS 18.4` through `18.7` and corresponding `iPadOS` versions. The malware was described as easy to deploy after its code was released on a popular code-sharing platform, lowering the barrier for cyber-espionage activity. Once executed, DarkSword can steal contacts, messages, call history, authentication-related data, and other sensitive information, then exfiltrate it to attacker-controlled servers before deleting itself from the device to hinder detection. New reporting says the operation has since grown into a broad malicious web infrastructure spanning **180 web properties and 27 hosts**, using fake Apple sign-in pages, Apple-themed lures, and compromised websites to deliver a leaked six-vulnerability exploit chain and **GHOSTBLADE** data-theft modules. Researchers said successful compromise can expose keychain contents, iCloud data, Wi-Fi credentials, files, and Apple ID credentials, while operators rotate servers quickly and remove artifacts such as crash reports and `RemoteLog.log` to frustrate forensic analysis. Defenders were urged to apply Apple security updates, enable **Lockdown Mode** where patching is delayed, and monitor for recurring infrastructure fingerprints tied to the campaign.
Aug 4, 2026