DarkSword iOS Exploit Kit: Six Vulnerabilities, Three Zero-Days, and Full Device Takeover

Overview

Security researchers at Google Threat Intelligence Group (GTIG), iVerify, and Lookout have jointly disclosed a sophisticated full-chain iOS exploit kit dubbed DarkSword, active since at least November 2025. The kit targets iPhones running iOS 18.4 through 18.7 and has been deployed by multiple distinct threat actors — including a suspected Russian espionage group and at least one commercial surveillance vendor — in campaigns spanning Saudi Arabia, Turkey, Malaysia, and Ukraine. DarkSword is only the second iOS exploit kit to be discovered within a single month, following the earlier disclosure of Coruna, and its emergence signals a maturing and increasingly accessible market for high-end mobile offensive capabilities.

Vulnerability Details

DarkSword chains six distinct vulnerabilities to achieve full device takeover. Three of these were exploited as zero-days — before Apple had issued any patch or public advisory:

How DarkSword Works: The Full Exploit Chain

DarkSword is delivered exclusively via watering hole attacks — compromised websites containing a malicious iFrame that loads a JavaScript fingerprinting payload. When a visitor arrives via Safari, the script silently determines whether the device is a viable target (specifically an iPhone running a vulnerable iOS version) before routing it into the exploit chain. The entire process, from initial visit to data exfiltration, can complete in a matter of seconds.

The attack proceeds through four distinct stages:

1. Initial Remote Code Execution (RCE): A JavaScriptCore JIT vulnerability — either CVE-2025-31277 or CVE-2025-43529 depending on the iOS version — is exploited within Safari's renderer (WebContent) process. A Pointer Authentication Code (PAC) bypass via CVE-2026-20700 in dyld is then used to facilitate code execution in user mode.
2. First Sandbox Escape (WebContent → GPU Process): A memory corruption flaw in ANGLE (CVE-2025-14174) and a kernel memory management vulnerability (CVE-2025-43510) are chained together to escape Safari's WebContent sandbox and pivot into the GPU process via WebGPU. GTIG noted that these same two sandbox escape exploits are used regardless of which RCE path was taken.
3. Second Sandbox Escape (GPU Process → mediaplaybackd): From the GPU process, the kit pivots into mediaplaybackd, a privileged Apple system daemon responsible for media playback. This gives the attacker access to restricted areas of the file system.
4. Kernel Privilege Escalation and Data Exfiltration: A kernel memory corruption flaw (CVE-2025-43520) is leveraged to obtain arbitrary read/write and arbitrary function call capabilities inside mediaplaybackd. An orchestrator module then loads GHOSTBLADE — the dataminer payload — which injects into Springboard to stage and exfiltrate collected data to an external server over HTTP(S).

"DarkSword aims to extract an extensive set of personal information, including credentials from the device and specifically targets a plethora of crypto wallet apps, hinting at a financially motivated threat actor. Notably, DarkSword appears to take a 'hit-and-run' approach by collecting and exfiltrating the targeted data from the device within seconds or at most minutes, followed by cleanup." — Lookout Security Research

What Data Is Exfiltrated

GHOSTBLADE is designed for comprehensive device data harvesting. The following categories of data are targeted:

• Email content and account credentials
• iCloud Drive files
• Contacts and call history
• SMS and iMessage histories
• Safari browsing history and session cookies
• Cryptocurrency wallet and exchange application data
• Saved usernames and passwords
• Photos and videos
• Wi-Fi network configurations and stored passwords
• Location history
• Calendar entries
• Cellular and SIM card information
• Installed application list
• Apple Notes and Apple Health data
• Telegram and WhatsApp message histories

Once exfiltration is complete, DarkSword deletes all staged files and exits cleanly, deliberately minimising dwell time and the on-device artefacts available for post-incident forensic analysis. This hit-and-run behaviour makes detection after the fact significantly more challenging than with persistent spyware such as Pegasus.

Threat Actors Using DarkSword

Three distinct threat actors have been attributed to DarkSword deployments, each with differing tooling and targets:

GTIG noted that UNC6353's December 2025 deployments only supported iOS 18.4–18.6, whilst activity attributed to UNC6748 and PARS Defense also covered iOS 18.7, indicating separate versioning tracks within the kit — consistent with a commercially maintained exploit platform sold or leased to multiple buyers.

The Exploit Proliferation Problem

The emergence of DarkSword — just weeks after Coruna — raises uncomfortable questions about the scale and accessibility of the commercial iOS exploit market. Both kits were deployed via watering hole attacks requiring no user interaction beyond a single page visit, and both were discovered not through active detection but through operational security failures on the part of the threat actors.

"For the second time in a month, threat actors have employed waterhole attacks to target iPhone users. Notably, neither of these attacks was individually targeted. The combined attacks now likely affect hundreds of millions of unpatched devices running iOS versions from 13 to 18.6.2." — iVerify

The fact that DarkSword's code contains references to iOS 17.4.1 and 17.5.1 suggests the kit was ported from an earlier version targeting older iOS releases — indicating sustained, professional development over an extended period. Lookout described the malware as a professionally designed platform engineered for maintainability and extensibility, with modules written in high-level JavaScript to facilitate rapid development of new capabilities.

Recommended Mitigations

The attack requires no user interaction beyond visiting a compromised website via Safari. The following mitigations should be applied as a matter of urgency:

Detection Indicators

Given DarkSword's hit-and-run approach and active cleanup routine, on-device forensic artefacts will be limited. Defenders and incident responders should focus on network-layer and infrastructure indicators:

• DNS queries or HTTP(S) connections to snapshare[.]chat or any domain associated with UNC6748 or PARS Defense infrastructure.
• Outbound HTTPS connections from iOS devices to unknown or newly registered domains immediately following a web browsing session — particularly in short, high-volume bursts consistent with bulk data exfiltration.
• Unexpected process activity involving mediaplaybackd or Springboard during or after a Safari browsing session, visible via MDM telemetry.
• Anomalous iCloud activity — particularly large volumes of file access or download events — shortly after device compromise.
• Visits to domains hosting malicious iFrame elements with fingerprinting JavaScript targeting iOS user-agent strings — detectable via proxy or DNS filtering logs.
• Any device telemetry indicating access to cryptocurrency wallet application data stores (com.bitcoin.*, io.metamask.*, etc.) by unexpected processes.

Conclusion

DarkSword represents one of the most technically sophisticated mobile threats publicly documented to date. A six-vulnerability chain including three zero-days, a two-stage sandbox escape, a kernel privilege escalation, and a professionally engineered infostealer — all delivered silently via a single web page visit — places this firmly at the apex of the mobile threat landscape. The fact that it has been made available to multiple actors of varying capability and motivation makes it significantly more dangerous than a tool reserved for a single nation-state operation.

The most immediate and effective defence is straightforward: update to iOS 18.7.3 or later without delay. Every day a device remains on an earlier version is a day it remains fully exposed to a weaponised exploit chain that takes seconds to execute and leaves little evidence behind.