Researchers Detail DarkSword iOS Exploit Kit Chaining Six Flaws
Summary
GTIG, Lookout and iVerify report DarkSword, a JavaScript iOS exploit kit observed across four countries, chaining six flaws for kernel access and data theft. Apple patched the chain in iOS 18.7.3 and iOS 26.3.
Key points
- Attackers injected invisible iframes into novosti[.]dn[.]ua and 7aac[.]gov[.]ua; the payload server reportedly delivered exploit code only to devices with Ukrainian IP addresses.
- The JavaScript-only chain escapes WebKit's sandbox, uses WebGPU to inject into mediaplaybackd, and gains kernel read-write access.
- The six-flaw chain includes CVE-2025-31277, CVE-2025-43529 and CVE-2026-20700; the article describes the remaining three flaws as enabling sandbox escape and privilege escalation.
- After compromise, GHOSTBLADE, GHOSTKNIFE and GHOSTSABER payloads reportedly collect messages, photos, passwords, iCloud files and cryptocurrency wallet data, then erase staged files.
- GTIG tracked deployments from at least November 2025 across Saudi Arabia, Turkey, Malaysia and Ukraine, involving multiple operators, including commercial surveillance vendors and suspected UNC6353.
- Lookout linked delivery infrastructure to a domain previously tied by GTIG to UNC6353, which it says has added DarkSword to its watering-hole campaigns.
- The article says Apple completed fixes in iOS 18.7.3 and iOS 26.3; Google added delivery domains to Safe Browsing, and Lockdown Mode may reduce risk on devices that cannot yet be updated.
Article Details
- Attack Vectors
- An invisible malicious iframe on compromised Ukrainian websites loads the exploit code when Safari visits the page; no further user interaction is required.
- The JavaScript-based exploit chain uses six iOS vulnerabilities to break out of the WebKit sandbox and obtain kernel read-write access.
- The attacker-controlled delivery server reportedly served the payload only to devices with Ukrainian IP addresses.
- After compromise, the payload injects data-theft modules into device processes, collects data, exfiltrates it to a command-and-control server, and deletes staged files.
- Defensive Notes
- Install iOS 18.7.3 or iOS 26.3 or later; the article says these versions include complete remediation for the six vulnerabilities.
- Google added DarkSword delivery domains to Safe Browsing.
- For devices that cannot be updated immediately, Apple’s Lockdown Mode can reduce the available attack surface.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cdncounter[.]net | Reported DarkSword delivery domain; Lookout linked its infrastructure characteristics to uacounter[.]com. |
| DOMAIN | uacounter[.]com | Domain previously tied by GTIG to suspected UNC6353 activity and linked by Lookout to the DarkSword delivery domain. |
MITRE ATT&CK
T1005 · Data from Local SystemPost-compromise modules collect data stored on the iPhone, including messages, photos, passwords, and iCloud files.T1041 · Exfiltration Over C2 ChannelThe collected data is exfiltrated to a command-and-control server.T1055 · Process InjectionThe chain uses WebGPU to inject into mediaplaybackd and later injects data-theft modules into targeted processes.T1059.007 · JavaScriptThe article describes the exploit chain and its payload orchestrator, pe_main.js, as JavaScript-based.T1068 · Exploitation for Privilege EscalationThe exploit chain escalates privileges through vulnerabilities to obtain kernel read-write access.T1070.004 · File DeletionThe article says staged files are deleted after exfiltration.T1189 · Drive-by CompromiseDarkSword is delivered through an invisible iframe on compromised websites visited by the target.T1203 · Exploitation for Client ExecutionA malicious webpage triggers JavaScriptCore memory-corruption exploits in Safari to execute the exploit chain.T1480 · Execution GuardrailsThe delivery server reportedly serves the payload only to devices with Ukrainian IP addresses.
CVE
CVE-2025-31277Apple · iOS and iPadOS; Apple · macOS; +19 morevulnerabilities in JavaScriptCore — the JavaScript engine that powers WebKit and Safari. The first, CVE-2025-31277, formed the foundation of the earliest observed DarkSword deployments targeting iOS 18.4 and 18.5.CVE-2025-43529Apple · iOS and iPadOS; Apple · macOS; +4 moreA second JavaScriptCore memory corruption bug, CVE-2025-43529, was added in a later iteration of the kit targeting iOS 18.6, giving operators redundant entry points across a wider version range.CVE-2026-20700Apple · iOS and iPadOS; Apple · macOS; +3 moreAlongside either RCE exploit, DarkSword chains CVE-2026-20700, a Pointer Authentication Code (PAC) bypass in dyld — the dynamic linker responsible for loading code into Apple processes.
Threat Actors
Malware
Corunaa domain GTIG previously tied to UNC6353 — a suspected Russian espionage group that also used the earlier Coruna iOS exploit kit against Ukrainian targets.DarkSwordDarkSword is a JavaScript-only iOS full-chain exploit kit that can compromise an iPhone via a single page load on compromised Ukrainian websites, break out of the WebKit sandbox, escalate to kernel read-write access,GHOSTBLADEPost-exploitation payloads (GHOSTBLADE, GHOSTKNIFE, GHOSTSABER) harvest SMS/iMessage, call history, photos, passwords, Telegram/WhatsApp histories, iCloud files, and cryptocurrency wallet keys.GHOSTKNIFEPost-exploitation payloads (GHOSTBLADE, GHOSTKNIFE, GHOSTSABER) harvest SMS/iMessage, call history, photos, passwords, Telegram/WhatsApp histories, iCloud files, and cryptocurrency wallet keys.GHOSTSABERPost-exploitation payloads (GHOSTBLADE, GHOSTKNIFE, GHOSTSABER) harvest SMS/iMessage, call history, photos, passwords, Telegram/WhatsApp histories, iCloud files, and cryptocurrency wallet keys.
Vendors
Applecountries and multiple operators — including commercial spyware vendors and the suspected UNC6353 — and Apple patched the chained vulnerabilities in iOS 26.3 / iOS 18.7.3.GoogleApple rolled out fixes across iOS 26.1–26.3 with final remediation in iOS 18.7.3; Google added delivery domains to Safe Browsing and Lockdown Mode can reduce risk for unpatched devices.iVerifyGTIG, Lookout, and iVerify tracked deployments across at least four countries and multiple operators — including commercial spyware vendors and the suspected UNC6353 — and Apple patched the chained vulnerabilities inLookoutGTIG, Lookout, and iVerify tracked deployments across at least four countries and multiple operators — including commercial spyware vendors and the suspected UNC6353 — and Apple patched the chained vulnerabilities in
Products
iCloud Drivebook, WiFi passwords, Safari browsing history and cookies, location history, health data, photos, iCloud Drive, emails, saved passwords, WhatsApp and Telegram message histories, and the complete list of installediOSDarkSword is a JavaScript-only iOS full-chain exploit kit that can compromise an iPhone via a single page load on compromised Ukrainian websites, break out of the WebKit sandbox, escalate to kernel read-write access,Lockdown ModeApple rolled out fixes across iOS 26.1–26.3 with final remediation in iOS 18.7.3; Google added delivery domains to Safe Browsing and Lockdown Mode can reduce risk for unpatched devices.SafariOnce Safari loaded the iframe, DarkSword executed a disciplined, multi-stage attack entirely in JavaScript — a design choice that is itself significant.Safe BrowsingApple rolled out fixes across iOS 26.1–26.3 with final remediation in iOS 18.7.3; Google added delivery domains to Safe Browsing and Lockdown Mode can reduce risk for unpatched devices.WebKitthat can compromise an iPhone via a single page load on compromised Ukrainian websites, break out of the WebKit sandbox, escalate to kernel read-write access, and exfiltrate messages, photos, passwords, Telegram
Countries
EstoniaBoth sites contained an invisible malicious iframe injected by attackers, which silently loaded exploit code hosted on a server in Estonia.MalaysiaResearchers observed deployments in Saudi Arabia, Turkey, Malaysia, and Ukraine by multiple actors, including suspected state-linked UNC6353 and commercial surveillance vendors.RussiaAlso read: How Russia-Linked Spies Turned Everyday Websites into Surveillance Traps aka ‘Watering Hole’Saudi ArabiaResearchers observed deployments in Saudi Arabia, Turkey, Malaysia, and Ukraine by multiple actors, including suspected state-linked UNC6353 and commercial surveillance vendors.TurkeyResearchers observed deployments in Saudi Arabia, Turkey, Malaysia, and Ukraine by multiple actors, including suspected state-linked UNC6353 and commercial surveillance vendors.UkraineResearchers observed deployments in Saudi Arabia, Turkey, Malaysia, and Ukraine by multiple actors, including suspected state-linked UNC6353 and commercial surveillance vendors.