DarkSword Exposes the Hidden iOS Exploit Market: Zero-Days in…

DarkSword exploits six Apple vulnerabilities — three zero-days — to achieve full iPhone takeover. Three threat groups of differing geography and motivation have already used the kit; its unobfuscated code reveals a mature secondary exploit market.

DarkSword is an iOS exploit kit active since November 2025 and discovered in March 2026 by Lookout during analysis of UNC6353 infrastructure. It exploits six vulnerabilities — three zero-days — to achieve complete takeover of iPhones running iOS 18.4 through 18.7, stealing sensitive data and crypto wallet credentials in a "hit-and-run" mode that makes post-attack discovery extremely difficult. Three threat actors of different geography and motivation have already employed the kit: a suspected Russian espionage group, financially motivated actors, and a Turkish commercial surveillance vendor.

Key Takeaways

The full technical chain moves from Safari to JavaScriptCore JIT, then via WebGPU/ANGLE to the GPU process, to mediaplaybackd, and finally to the iOS kernel with arbitrary privilege escalation.
Three of the six flaws were zero-days at time of use: CVE-2026-20700, CVE-2025-43529, and CVE-2025-14174; CVE-2026-20700 was patched by Apple only in iOS 26.3 after discovery by Google TAG.
UNC6353, UNC6748, and PARS Defense used DarkSword with different payloads (GHOSTBLADE, GHOSTKNIFE, GHOSTSABER) against targets in Ukraine, Saudi Arabia, Turkey, and Malaysia.
The kit's JavaScript code is completely unobfuscated, with references to iOS 17.4.1 and 17.5.1 indicating a port from earlier framework versions.

How the Attack Chain Works: From Browser to Kernel in Three Hops

The initial compromise occurs via Safari and a memory corruption vulnerability in JavaScriptCore, identified as CVE-2025-31277 with CVSS 8.8 per the NVD record. This first step achieves arbitrary code execution within the WebContent sandbox. From here begins DarkSword's true path, which does not stop at the initial RCE but targets a double sandbox escape.

The Google Threat Intelligence Group (GTIG) documented the mechanism precisely: "DarkSword uses two separate sandbox escape vulnerabilities, first by pivoting out of the WebContent sandbox into the GPU process, and then by pivoting from the GPU process to mediaplaybackd." The pivot exploits WebGPU APIs and the ANGLE graphics framework to force the transition from the browser's isolated context to the GPU process, then to the mediaplaybackd daemon with broader privileges. Only at this point does kernel privilege escalation intervene via CVE-2025-43510 and CVE-2025-43520, both patched by Apple in iOS 18.7.2 and 26.1.

The final payload, dubbed GHOSTBLADE by Lookout, is written entirely in JavaScript. Lookout described it as "a professionally designed platform enabling rapid development of modules through access to a high-level programming language." The choice of an interpreted language for an infostealer of this caliber is unusual: it slashes development and adaptation time, but also exposes the internal structure to anyone who obtains a sample.

The OPSEC Paradox: Naked Code in Spies' Hands

The most disturbing finding is not technical but operational. Lookout observed "the complete lack of obfuscation in DarkSword code," a total absence of obfuscation techniques in both the JavaScript and the command-and-control infrastructure. For a group like UNC6353, active in espionage operations against Ukrainian targets since December 2025 with access to nation-state-grade zero-days, this carelessness is anomalous.

Lookout's proposed explanation opens a broader scenario: "Given that both Coruna and DarkSword have capabilities for cryptocurrency theft and intelligence gathering, we must consider the possibility that UNC6353 is a Russia-backed privateer group or criminal proxy threat actor." The concept of a "privateer group" — a hybrid actor operating for state interest but with criminal structures and resources — explains the inconsistency between exploit sophistication and OPSEC poverty. The group has access to capabilities developed by others; it does not guard them as national treasure.

Code references to iOS 17.4.1 and 17.5.1 confirm that DarkSword was not built from scratch for iOS 18. It is a port of a previous framework, adapted to cover newer versions. This indicates a long exploit product lifecycle and a maintenance investment incompatible with a one-off operator.

Three Actors, Three Payloads, One Market

DarkSword's proliferation beyond UNC6353 is the clearest signal of a mature secondary market. UNC6748 used the kit in November 2025 against Saudi users via the Snapchat-themed site snapshare[.]chat, deploying the GHOSTKNIFE payload. PARS Defense, a Turkish commercial surveillance vendor, operated in November 2025 and January 2026 against Turkey and Malaysia with GHOSTSABER. No infrastructure overlaps emerge linking the three actors directly: each received or purchased the kit independently.

"The use of both DarkSword and Coruna by a variety of actors demonstrates the ongoing risk of exploit proliferation across actors of varying geography and motivation" — Google Threat Intelligence Group

GTIG summarized the phenomenon with this direct quote, underscoring that the spread concerns not only DarkSword but a broader pattern. The Coruna kit, mentioned as a parallel, is a distinct product with different iOS targets; the link is UNC6353's use of both and the market they both reveal. The source does not specify PARS Defense's exact role: develops in-house, buys, or resells? The dossier does not clarify.

The targeted version range spans iOS 18.4 to 18.7, with UNC6353 focused on earlier versions and UNC6748/PARS covering 18.7 as well. The fragmentation of targets suggests kit customization for different customers, not a single centralized campaign.

Exfiltration Time: Seconds, Not Hours

DarkSword's operational mode is designed for invisibility. Lookout documented that the kit "collecting and exfiltrating the targeted data from the device within seconds or at most minutes, followed by cleanup." This "hit-and-run" architecture eliminates malware persistence on the device, the traditional weak point for forensic discovery. Once data — credentials, personal information, crypto wallet contents — is exfiltrated, the code self-destructs or removes operational traces.

Lookout further specified the financial target: "DarkSword aims to extract an extensive set of personal information, including credentials from the device and specifically targets a plethora of crypto wallet apps, hinting at a financially motivated threat actor." This description refers to the observed usage pattern, not necessarily the nature of all actors: UNC6353 employed the same kit in a geopolitical context, demonstrating the product's versatility.

The absence of persistence drastically complicates incident response. Without residual artifacts, detection depends exclusively on real-time behavioral monitoring — anomalous traffic, access to known endpoints, exfiltration patterns — rather than post-facto indicator-of-compromise hunting.

Why This Matters

The dossier does not specify specific remedial measures taken by Apple beyond the release of the mentioned patches. The brief does not document explicit operational recommendations from researchers for users or organizations.

The finding that emerges forcefully is the scale of exposure risk. iVerify estimated that combined Coruna and DarkSword attacks affect "hundreds of millions of unpatched devices running iOS versions from 13 to 18.6.2." This is an estimate of potentially exposed devices, not confirmed victims: the actual number of compromises is not quantifiable from available sources.

The CVSS of CVE-2025-43520 — 5.5 per NIST, with a CISA KEV entry confirming active exploitation — illustrates a known metric limitation. Evaluated in isolation, the flaw appears modest; inserted into the full chain with arbitrary kernel write, its technical impact is total. The discrepancy between formal score and actual chain danger is a warning for those relying solely on CVSS thresholds for prioritization.

The exact method of injection into compromised websites — watering hole attack — is "currently not known" per the primary source. It is unknown whether this occurs via server compromise, advertising supply chain, or another vector. The kit's origin remains equally undetermined: developed in-house, acquired, or derived from code leaks? References to iOS 17 suggest evolutionary continuity, not provenance.

The DarkSword case confirms that the secondary iOS exploit market has reached a maturity that democratizes capabilities once reserved for national intelligence operators. Unobfuscated code, exfiltration speed, multiplicity of users: these elements compose a picture of exploits as standardized commercial products, not bespoke weapons. For iOS users, the consequence is that visiting a compromised legitimate site can translate into total data theft without any required interaction. For organizations, the case indicates that Apple's closed ecosystem no longer constitutes a sufficient perimeter: detection must shift to device behavior, not platform trust.

FAQ

Is DarkSword an active threat or has it been contained?

The three zero-days have been patched by Apple in iOS 18.6, 18.7.2, 26.1, and 26.3, but the kit remains effective on unpatched devices. The source does not document active campaigns after January 2026, but the absence of persistence makes detection of new use inherently difficult.

Why is the unobfuscated code significant?

Because it contradicts the operational profile of groups with access to nation-state zero-days. The strongest hypothesis is that UNC6353 did not develop the kit but acquired it, lacking the engineering resources to protect its structure or not deeming such protection necessary.

What is the real risk for an average iOS user?

The source does not quantify individual victims. Risk exists for those browsing compromised sites with unpatched devices; the attack requires no interaction. iVerify's estimate of "hundreds of millions" of exposed devices refers to the vulnerable population, not confirmed compromises.

Sources

Information is based on cited sources and current as of publication.

Sources

Sources and references