New iOS Exploit With Advanced iPhone Hacking Tools Attacking Users to Steal Personal Data
A sophisticated full-chain iOS exploit kit known as DarkSword has been actively utilized by various surveillance vendors and state-sponsored threat actors since at least November 2025. It targets iPhone users in multiple countries to extract sensitive…
A sophisticated full-chain iOS exploit kit known as DarkSword has been actively utilized by various surveillance vendors and state-sponsored threat actors since at least November 2025. It targets iPhone users in multiple countries to extract sensitive personal data.
DarkSword comprises a full-chain iOS exploit that utilizes six distinct vulnerabilities, including four zero-days, to fully compromise devices running iOS versions 18.4 through 18.7.
This exploit chain operates via JavaScript, enabling attackers to bypass Apple's Page Protection Layer (PPL) and Secure Page Table Monitor (SPTM), which typically prevent the execution of unsigned native binary code.
The exploit has been analyzed by GTIG, iVerify, and Lookout, who confirmed its deployment in targeted campaigns affecting users in Saudi Arabia, Turkey, Malaysia, and Ukraine.
The exploit chain begins with a remote code execution (RCE) exploit targeting JavaScriptCore, Apple's JavaScript engine used in Safari and WebKit. It progresses through two stages of sandbox escape, local privilege escalation, and a final payload deployment that grants full kernel-level privileges.
Notably, CVE-2026-20700, a Pointer Authentication Code (PAC) bypass in Apple's dyld dynamic linker, was directly tied to the RCE exploits and was patched with iOS 26.3 following a report by GTIG.
CVE Exploit Module Vulnerability Type Affected Component Zero-Day Patched In
CVE-2025-31277 rce_module.js JIT optimization / type confusion JavaScriptCore (WebKit) No iOS 18.6
CVE-2025-43529 rce_worker_18.6.js , rce_worker_18.7.js Use-after-free / garbage collection bug in DFG JIT layer JavaScriptCore (WebKit) Yes iOS 18.7.3, 26.2
It targets iPhone users in multiple countries to extract sensitive personal data.
CVE-2026-20700 rce_worker_18.4.js , rce_worker_18.6.js , rce_worker_18.7.js Memory corruption / user-mode PAC bypass dyld (Dynamic Linker) Yes iOS 26.3
CVE-2025-14174 sbox0_main_18.4.js , sbx0_main.js Out-of-bounds memory access in WebGL operation ANGLE (GPU process / WebKit) Yes iOS 18.7.3, 26.2
CVE-2025-43510 sbx1_main.js Memory management / copy-on-write bug XNU Kernel No iOS 18.7.2, 26.1
CVE-2025-43520 pe_main.js Kernel-mode race condition in VFS implementation XNU Kernel (Virtual Filesystem) No iOS 18.7.2, 26.1
GTIG identified three distinct post-exploitation malware families deployed following a successful DarkSword compromise, each tailored to specific threat actor requirements.
GHOSTKNIFE, deployed by threat cluster UNC6748 via a Snapchat-themed phishing site, is a JavaScript backdoor capable of extracting signed-in accounts, messages, browser data, location history, and audio recordings from the device's microphone.
It communicates with its command-and-control (C2) server using a custom binary protocol encrypted with ECDH and AES, and actively deletes crash logs from the device to evade forensic detection.
GHOSTSABER, deployed by Turkish commercial surveillance vendor PARS Defense, supports over 15 distinct C2 commands, including device enumeration, file exfiltration, arbitrary SQLite query execution, and photo thumbnail uploads.
Several GHOSTSABER commands, such as audio recording and real-time geolocation, are not fully implemented in the JavaScript implant itself, suggesting that follow-on binary modules are downloaded at runtime from the C2 server.
GHOSTBLADE, attributed to a suspected Russian espionage actor, functions as a comprehensive data miner, extracting iMessages, Telegram and WhatsApp data, cryptocurrency wallet data, Safari history and cookies, Health databases, device keychains, location history, and saved Wi-Fi passwords.
Unlike the other two families, GHOSTBLADE does not operate persistently or support interactive backdoor commands, but its extensive data collection capability makes it valuable for intelligence-gathering operations.
DarkSword was delivered through various methods, including a fraudulent Snapchat lookalike site and compromised Ukrainian websites with hidden iFrames. GTIG, alongside CERT-UA, is working to mitigate the ongoing campaigns associated with DarkSword.
All identified DarkSword vulnerabilities have been reported to Apple, and all six CVEs have been patched, with the majority addressed prior to, and the remainder with the release of iOS 26.3.
Google has added all identified DarkSword delivery domains to Safe Browsing. Users are strongly urged to update to the latest version of iOS immediately, and if updates are not available, enabling Lockdown Mode is recommended as an additional safeguard against this class of exploit.
Based on reporting by Cyber Security News.