Loading malware…
DarkSword is an iOS exploit kit used to compromise vulnerable iPhones and deploy data-theft and remote-control payloads. Observed in attacks since late 2025 and publicly documented in March 2026, its established six-vulnerability chain targets iOS 18.4 through 18.7. It combines browser exploitation, sandbox escapes, and kernel privilege escalation before injecting a payload into SpringBoard. Infection can begin when Safari loads a malicious webpage or embedded content on a compromised website, without requiring application installation or further approval.
DarkSword enables collection and exfiltration of credentials, Keychain data, messages, contacts, call histories, browsing records, location information, and cryptocurrency-wallet data. Early operations emphasized rapid collection and removal of traces rather than durable access. The P7 DarkSword variant adds bidirectional command-and-control, operating-system command execution, arbitrary JavaScript execution, filesystem reconnaissance, application enumeration, and selective extraction of files, notes, photographs, and wallet information. P7 also processes stolen Keychain data locally and suppresses diagnostic logging to reduce its footprint. Some deployments combine DarkSword's device-compromise chain with Coruna wallet-theft components.
Multiple actors have used DarkSword against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. Associated operators include the commercial surveillance vendor PARS Defense and UNC6353, which used compromised Ukrainian news and government websites for watering-hole attacks. Ukrainian targeting has included military personnel and government officials. Other campaigns use impersonation websites, invitation lures, and cryptocurrency-related collection objectives. A public source-code leak in 2026 facilitated wider reuse and modification. Apple has patched the established exploit chain; experimental adaptations do not establish successful compromise of current iOS releases.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
22 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
An analysis of the production server's exploit registry has revealed that the DarkSword exploit kit comprises two CVE identifiers not previously documented - CVE-2025-24201 ... an out-of-bounds write vulnerability in the WebKit engine that could allow an attacker to break out of the Web Content sandbox. | Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.
CVE-2025-31200 ... a memory corruption vulnerability in the Core Audio framework that allows code execution when processing an audio stream in a maliciously crafted media file (Fixed in iOS 18.4.1 and iPadOS 18.4.1). | Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
The campaign delivers an iOS Safari exploitation chain that is "highly consistent with the DarkSword iOS exploitation chain" and reuses its six-vulnerability chain to collect files, Keychain data, and keyboard input from targeted wallet applications.
Additionally, two vulnerabilities and a multi-component exploit kit were directly connected to active malware campaigns, including a sophisticated iOS full-chain exploit called DarkSword that delivered the GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE payloads.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
DarkSword is a fully weaponized iOS exploit kit, first identified in active campaigns as far back as November 2025 by Google’s Threat Intelligence Group (GTIG), iVerify, and Lookout. The toolkit specifically targets devices running iOS 18.4 through 18.7, leveraging a chain of six distinct vulnerabilities including bugs in JavaScriptCore, dyld, and the iOS sandbox to achieve full kernel-level code execution without any user interaction beyond a single website visit.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Star Blizzard demonstrated new capabilities, including targeting vulnerable Apple iOS devices to deploy the DarkSword backdoor, as reported by Proofpoint in March.
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.
“DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026.”
“DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026.”
Victims were served ClickFix-style lures to deliver Windows, Android, and iOS malware tailored to their device; DarkSword was the listed iOS malware.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
“During watering-hole attacks, the attackers compromised legitimate websites visited by the intended targets and modified them in order to deliver the attack.”
The loader consists of a 1,025-item string array, array shifting, and custom Base64 and RC4 applied to each string.
La page frauduleuse imite fidèlement le design d’Apple (logo, pied de page “Copyright © 2026 Apple Inc.”).
app.js coordinates obtaining three plugins and injecting them into SpringBoard (sync.js), securityd (auth.js), and kbd (input.js) via InjectJS.
“[DarkSword is] capable of extracting sensitive information within minutes and then erasing traces of the compromised device.”
“An invisible frame checks the visitor’s iOS version and selects the next code to load.” The first server message includes “a device identifier, device information, and status.”
“Its commands can list directories, retrieve files and full-size photos.”
209 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
90 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An iOS exploit kit observed in renewed drive-by exploitation activity originating from Chinese-language webpages. Injected iframes redirect visitors to domains hosting exploit kits targeting vulnerable, outdated iOS versions. The report states that current iOS versions are not vulnerable to these kits.
Legacy iOS exploitation tooling incorporated into Divine Seagull's Godkiller V1 implementation and reused by Liangri_26. Nextgen's speculative WASM attack tier also falls back to it. The article associates its original success with scammers and cryptocurrency thieves but emphasizes that legacy functionality does not establish current iOS 26 compatibility.
An iPhone exploit kit that chains six flaws to compromise susceptible devices through malicious web content, escape browser restrictions and obtain deeper system access. Reported theft includes passwords, messages, browsing records, location information and cryptocurrency wallet contents. Its source code was publicly leaked in 2026, facilitating reuse and modification. The content also describes attackers combining its exploitation capabilities with Coruna’s wallet-theft tools.
An iOS exploit kit that chains vulnerabilities to escape the browser sandbox, obtain kernel privileges, and inject an implant into SpringBoard. Detected in the wild in November 2025 and publicly documented in March 2026, it has been used against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. The P7 variant reduces logging, prevents repeat exploitation through browser localStorage, and extracts keychain data into JSON on-device before exfiltration. Its two-way C2 supports command polling, arbitrary operating-system commands and JavaScript execution, filesystem reconnaissance, and theft of application data, notes, photos, and cryptocurrency-wallet information.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.