DarkSword Exploit Chain Leaked Online, Posing Risk to Millions of iPhones
Security researchers have identified that the sophisticated iOS exploit chain known as DarkSword is now available beyond its initial threat actor groups.
Security researchers have identified that the sophisticated iOS exploit chain known as DarkSword is now available beyond its initial threat actor groups.
Recently, a security researcher successfully attained kernel read/write access on an iPad mini 6th generation running iOS 18.6.2 using the DarkSword exploit.
This development indicates that the exploit kit is highly viable and poses an immediate risk to millions of unpatched Apple devices worldwide.
DarkSword is a comprehensive exploit kit and infostealer written in JavaScript. The attack begins when a user visits a compromised website containing a malicious iframe, a technique known as a watering hole attack.
Upon loading the malicious page, the exploit breaks out of the Safari WebContent sandbox.
The attack bypasses Trusted Path Read-Only and Pointer Authentication Codes mitigations by exploiting sensitive internal dyld structures in writable stack memory.
Attackers pivot through the GPU process by exploiting an out-of-bounds write vulnerability in the ANGLE graphics engine.
From the GPU process, the exploit targets the XNU kernel by triggering a Copy-On-Write vulnerability in the AppleM2ScalerCSCDriver driver.
Security researchers have identified that the sophisticated iOS exploit chain known as DarkSword is now available beyond its initial threat actor groups.
This allows attackers to establish arbitrary memory read/write primitives, enabling them to modify sandbox restrictions and access restricted file systems.
Google Threat Intelligence Group initially observed DarkSword in active campaigns as early as November 2025.
The toolkit is attributed to UNC6353, a suspected espionage group that previously used the Coruna iOS exploit kit.
These attackers have deployed the exploit chain against targets in Ukraine, Saudi Arabia, Turkey, and Malaysia.
Operating entirely in memory, DarkSword rapidly loads scripts to deploy final-stage payloads.
Researchers identified three distinct malware families deployed post-compromise: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER.
These payloads exfiltrate sensitive data, including secure messages, saved credentials, and cryptocurrency wallet information.
The command and control infrastructure uses subdomains created on compromised legitimate websites, such as sqwas.shapelie[.]com .
The public validation of DarkSword by independent researchers significantly elevates the overall threat level.
System administrators and security teams must ensure all Apple devices are updated to iOS 26.1 or later, as these versions contain patches for the kernel vulnerabilities.
For high-risk individuals and enterprise targets, enabling Apple’s Lockdown Mode provides an additional layer of defense against complex web-based exploit chains.
Based on reporting by GBHackers.