DarkSword iOS Exploit Kit Used in Attacks by State-Backed and Commercial Spyware Actors
Summary
Researchers say the DarkSword iOS exploit kit was used in watering-hole attacks by UNC6353 against Ukraine and commercial surveillance actors in Saudi Arabia, Turkey and Malaysia. Its exploit chain can compromise devices and steal extensive data.
Key points
- Google, iVerify and Lookout reported that DarkSword targets six iOS vulnerabilities and can achieve full device compromise with minimal user interaction.
- The JavaScript exploit chain uses Safari vulnerabilities for remote code execution, escapes the sandbox, then exploits kernel flaws to escalate privileges.
- Researchers linked DarkSword use by UNC6353 to watering-hole attacks against Ukraine, and reported its use by commercial surveillance actors targeting Saudi Arabia, Turkey and Malaysia.
- The final payload can steal passwords, messages, photos, contacts, browser data, account information and cryptocurrency wallet data.
- Google identified three payloads in successful attacks: GhostBlade, GhostKnife and GhostSaber.
- Apple has patched the targeted vulnerabilities. iVerify estimates that 14.2% of users—about 221.5 million devices—running iOS 18.4 through 18.6.2 may remain vulnerable, and recommends updating to iOS 26.3.1 or 18.7.6.
Article Details
- Attack Vectors
- DarkSword was delivered through watering-hole attacks using malicious iframes injected into compromised legitimate websites, including the News of Donbas website and the Seventh Administrative Court of Appeals website.
- The JavaScript exploit chain begins by exploiting Safari bugs for remote code execution, then escapes Safari's sandbox through the GPU process and exploits XNU kernel flaws for privilege escalation and payload execution.
- The final payloads steal device information, including passwords, photos, messages, contacts, call history, browser data, Wi-Fi information, Apple Health data, and cryptocurrency wallet information.
- Defensive Notes
- Update to iOS 26.3.1 or 18.7.6, which the article identifies as versions containing patches for all vulnerabilities in DarkSword.
- Apple has rolled out patches for the vulnerabilities targeted by DarkSword and Coruna.
- Lookout notes that social-engineering training may not prevent watering-hole infections when victims visit a legitimate site that has been compromised.
MITRE ATT&CK
T1005 · Data from Local SystemThe final payload modules collect information from infected devices, including photos, messages, contacts, browser data, and files.T1059.007 · JavaScriptDarkSword is written in JavaScript and its payloads include JavaScript backdoors and arbitrary JavaScript code execution.T1068 · Exploitation for Privilege EscalationDarkSword exploits kernel flaws to achieve kernel privilege escalation.T1189 · Drive-by CompromiseDarkSword was delivered in watering-hole attacks through malicious iframes injected into compromised legitimate websites.T1203 · Exploitation for Client ExecutionThe exploit kit exploits Safari vulnerabilities to achieve remote code execution on iOS devices.T1211 · Exploitation for StealthThe chain exploits vulnerabilities to bypass TPRO and PAC protections and escape Safari's sandbox.
CVE
CVE-2025-14174Google · ChromeThe targeted vulnerabilities include CVE-2025-31277, CVE-2025-43529, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, and CVE-2026-20700.CVE-2025-31277Apple · iOS and iPadOS; Apple · macOS; +19 moreThe targeted vulnerabilities include CVE-2025-31277, CVE-2025-43529, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, and CVE-2026-20700.CVE-2025-43510Apple · iOS and iPadOS; Apple · macOS; +3 moreThe targeted vulnerabilities include CVE-2025-31277, CVE-2025-43529, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, and CVE-2026-20700.CVE-2025-43520Apple · iOS and iPadOS; Apple · macOS; +3 moreThe targeted vulnerabilities include CVE-2025-31277, CVE-2025-43529, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, and CVE-2026-20700.CVE-2025-43529Apple · iOS and iPadOS; Apple · macOS; +4 moreThe targeted vulnerabilities include CVE-2025-31277, CVE-2025-43529, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, and CVE-2026-20700.CVE-2026-20700Apple · iOS and iPadOS; Apple · macOS; +3 moreThe targeted vulnerabilities include CVE-2025-31277, CVE-2025-43529, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, and CVE-2026-20700.
Threat Actors
UNC6353Reportedly used DarkSword in watering-hole attacks against Ukraine beginning in December 2025, delivering the GhostBlade information stealer. Google also attributed earlier use of Coruna against Ukraine to UNC6353.UNC6748Google found evidence that UNC6748 used DarkSword in attacks targeting Saudi Arabia, including a November 2025 watering-hole attack that delivered GhostKnife.
Malware
GHOSTBLADEOver the past five months, Google identified three payloads dropped in successful DarkSword attacks, namely GhostBlade, GhostKnife, and GhostSaber.GHOSTKNIFEOver the past five months, Google identified three payloads dropped in successful DarkSword attacks, namely GhostBlade, GhostKnife, and GhostSaber.GHOSTSABEROver the past five months, Google identified three payloads dropped in successful DarkSword attacks, namely GhostBlade, GhostKnife, and GhostSaber.
Vendors
AppleNamed DarkSword, it targets six vulnerabilities in Apple’s mobile platform and leads to full device compromise with minimal user interaction.PARS DefenseIn late November, commercial surveillance vendor PARS Defense employed DarkSword in attacks against users in Turkey, and in January 2025 used it in attacks against Malaysian users.
Products
iOSSecurity researchers have discovered another sophisticated iOS exploit kit and found evidence that it has been used by both state-sponsored hackers and commercial spyware vendors.SafariWritten completely in JavaScript, DarkSword starts with the exploitation of Safari bugs to achieve remote code execution (RCE), continues with a sandbox escape, and shifts to exploiting kernel flaws to inject and
Tools
CorunaIn early March, Google and iVerify shared details on Coruna, a powerful exploit kit targeting 23 vulnerabilities in iOS 13 through 17.2.1, including nearly a dozen zero-days.DarkSwordNamed DarkSword, it targets six vulnerabilities in Apple’s mobile platform and leads to full device compromise with minimal user interaction.
Countries
MalaysiaGoogle has also found evidence that DarkSword has been used by commercial surveillance vendors, including one tracked as UNC6748, in attacks targeting Saudi Arabia, Turkey, and Malaysia.Saudi ArabiaGoogle has also found evidence that DarkSword has been used by commercial surveillance vendors, including one tracked as UNC6748, in attacks targeting Saudi Arabia, Turkey, and Malaysia.TurkeyGoogle has also found evidence that DarkSword has been used by commercial surveillance vendors, including one tracked as UNC6748, in attacks targeting Saudi Arabia, Turkey, and Malaysia.UkraineA Russian state-sponsored espionage group tracked as UNC6353 has been using the iOS exploit kit in attacks against Ukraine.