DarkSword: JavaScript iOS Exploit Kit Strikes via Compromised Legitimate Sites

On March 24, 2026, Apple released iOS 18.7.7, a retroactive patch addressing an exploit chain dubbed DarkSword. The kit, analyzed by iVerify with elements corroborated by Lookout and Google Threat Intelligence, compromises iPhones and iPads through JavaScript executed in Safari. It requires the user to visit a compromised site — a user action, not a zero-click attack. In an unusual move, Apple extended fixes to iOS 18 without requiring an upgrade to iOS 26.

From /rce_loader.js to the Kernel: A Fileless Chain

iVerify reconstructed the full attack chain starting from compromised legitimate Ukrainian sites via iframe injection into /widget.js. The server, located in Estonia, was globally accessible but served exploits exclusively to Ukrainian IP addresses, as documented in NGINX logs last modified December 23, 2025.

The exploit chain is built entirely in JavaScript. It contains no traditional binary implant or Mach-O library, as iVerify's technical analysis explicitly states. The initial /rce_loader.js file exploits JIT (Just-In-Time) vulnerabilities in JavaScriptCore to gain arbitrary memory read/write. Two distinct JIT bugs are conditionally selected based on iOS version: a type confusion in JIT RegExp match for iOS 18.4–18.5, and a use-after-free/type confusion in JIT StoreBarrierInsertionPhase for iOS 18.6–18.6.2.

To bypass TPRO (Task Port Restrictions), PAC (Pointer Authentication Codes), and SPRR/JIT Cage protections, attackers abuse internal dyld structures in writable stack memory, a technique iVerify documents as specific. From there, the chain pivots through an out-of-bounds write vulnerability in the GPU/ANGLE process to escape the Safari sandbox.

Kernel escalation occurs via injection of /pe_main.js into the mediaplaybackd daemon. iVerify confirmed kernel privilege escalation through forensic capture; a full filesystem dump is impossible without a jailbreak. The entire payload operates in transient memory. iVerify reports the kit self-deletes after data extraction.

"The entire chain is not obfuscated and contains verbose logging and commentary on how to use exploits and implants" — iVerify, DarkSword technical analysis

Six CVEs, Three in CISA's KEV Catalog with Federal Deadline

Lookout enumerated six vulnerabilities exploited in the DarkSword chain: CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520. Three of these — CVE-2025-31277, CVE-2025-43510, CVE-2025-43520 — were added to CISA's Known Exploited Vulnerabilities catalog on March 20, 2026, with a remediation deadline of April 3, 2026 for U.S. federal agencies.

Apple confirmed in its support advisory that "fixes associated with the DarkSword exploit were first shipped in 2025." This aligns the timeline with Google Threat Intelligence's observation, which reported the vulnerabilities to Apple in the second half of 2025 and first documented DarkSword use by UNC6748 in November 2025, in the context of targeted attacks against Saudi Arabia via the snapshare[.]chat domain.

On March 24, 2026, Apple released iOS 18.7.7 for a limited set of devices, expanding availability on April 1, 2026. The decision to backport fixes without requiring migration to iOS 26 is described in sources as an "unusual departure" from the company's standard policy, which typically conditions security patches on the latest major release. Rocky Cole, iVerify COO, commented that "Apple has at least agreed with the security community's assessment that this represents a clear and present threat to devices that remain unpatched on previous iOS versions."

Multi-Actor Proliferation: From Nation-State to Commercial Market

Google Threat Intelligence identified three post-exploitation malware families associated with DarkSword: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. The analysis documents use of the kit by diverse, geographically distant threat actors.

UNC6748, observed in November 2025 against Saudi targets, uses GHOSTBLADE. PARS Defense, a commercial surveillance vendor based in Turkey, was observed with GHOSTSABER. UNC6353, linked to the previously documented Coruna exploit kit, shares infrastructure with DarkSword. Google also signals "likely other commercial surveillance vendors" among the kit's users, without naming them specifically.

Lookout assesses "with high confidence" that DarkSword activity is associated with Russian-aligned cyber-espionage operations and financially motivated threat activity. The proliferation documented by Google — actors in Ukraine, Saudi Arabia, Turkey, and Malaysia — indicates the kit has crossed the boundaries of a single operator.

Why Deaf Users Face Higher Watering-Hole Risk

DarkSword's structure breaks the assumption that compromising iOS requires a malicious app or configuration profile. The vector is the web browser, the primary communication medium for many deaf users who rely on web-based services for video calls, interpreting, and visual messaging.

This reliance creates a specific attack surface. Apps like Glide, Marco Polo, or video interpreting platforms operate in the browser or redirect to web links. A deaf user receiving a link in these apps — apparently from a known contact whose account is compromised — performs the required action: a tap, a visit, a 1-click. No installation is needed.

iOS security alerts are primarily auditory or haptic. Visual system notifications can go unnoticed during a full-screen video call. DarkSword's lack of persistence means no post-attack visual indicators: no unknown apps, no anomalous battery drain. The user has no elements to suspect compromise.

The geofencing observed by iVerify — exploits delivered only to Ukrainian IPs — does not guarantee protection for users in other regions. The multi-actor proliferation documented by Google indicates the kit is already circulating among operators with different targets.

What to Do: Checklist for iOS Users

• Verify automatic updates: Settings > General > Software Update > Automatic Updates. Enable "Download iOS Updates" and "Install iOS Updates." iOS 18.7.7 is available for compatible devices; upgrading to iOS 26 is not required to receive the patch.
• Check installed version: Settings > General > About. If the version is between 18.4 and 18.7, confirm the update has been applied.
• Watch links in visual communication apps: Glide, Marco Polo, video interpreting platforms, and deaf community chats can convey links to compromised sites. Verify the domain before opening: press and hold the link to see the full URL, not just the preview.
• Prefer native apps over browser: If a service has an official App Store app, use it instead of the web version. DarkSword triggers via Safari; the native app reduces the attack surface.
• Enable visual security notifications: Settings > Notifications > Ensure "Security Alerts" are visible even with "Do Not Disturb" active, common during video calls.

iVerify's estimate — roughly 20% of users on previous iOS versions — is not confirmed by Apple, but the decision to backport the patch suggests a significant attack surface.

Editorial Close

DarkSword demonstrates that the line between everyday browsing and total compromise has thinned to a single tap. For the deaf community, where digital communication is often visual and web-centric, this thinning has concrete implications. Security is no longer a question of what you install, but where you click — and who controls the site you're visiting.