DarkSword: The iOS Exploit Kit Putting APT-Grade Attacks Within Reach

DarkSword is a full-chain iOS exploit kit discovered by Lookout Threat Labs in collaboration with Google Threat Intelligence Group and iVerify. Active since November 2025, it has been observed in watering-hole campaigns against targets in Ukraine, Saudi Arabia, Turkey, and Malaysia. The kit exploits six vulnerabilities, three of them zero-days, to compromise iPhones running iOS 18.4–18.7 and steal credentials, crypto-wallet data, and personal content in a window measured in seconds or, at most, minutes. The significance is not only technical: Google GTIG has observed multiple actors using DarkSword, indicating the kit circulates on a secondary iOS exploit market that lowers the barrier to capabilities once reserved for state-sponsored groups.

How the Kill Chain Works: From Safari to Kernel in JavaScript

DarkSword's kill chain stands out for its extensive use of JavaScript, a choice that accelerates development and modification compared to traditional compiled-language toolchains. The flow begins with a malicious iframe loaded on compromised sites, which invokes rce_loader.js for target device fingerprinting. If the system falls within the vulnerable range, the exploit proceeds with an escape from the Safari WebContent sandbox, followed by escalation via WebGPU to injection into the mediaplaybackd process and the achievement of kernel read-write.

At this point pe_main.js takes over as the orchestrator, coordinating modular payloads injected into privileged system services: configd, wifid, securityd, and UserEventAgent. Exfiltration occurs via Springboard, the iOS launcher, exploiting a channel that reduces anomalies detectable by traditional monitoring tools. Code references to iOS 17.4.1 and 17.5.1 indicate DarkSword represents an evolution of prior kits, not a from-scratch creation.

Targets: Crypto Wallets and Personal Data in Geolocated Campaigns

According to the Lookout report cited by SecurityAffairs, DarkSword "aims to extract an extensive set of personal information including credentials from the device and specifically targets a plethora of crypto wallet apps, indicating a financially motivated actor." Named apps include Coinbase, Binance, Kraken, Ledger, Trezor, and MetaMask. Beyond wallet data, the kit collects photos, email, and Telegram and WhatsApp history.

Campaign geolocation is verified for Ukraine, where the kit was distributed through compromised sites including 7aac.gov[.]ua, a government domain, via the cdncounter[.]net infrastructure and its subdomain static.cdncounter[.]net. Saudi Arabia, Turkey, and Malaysia appear as targeted countries in Google GTIG observations, but the dossier does not specify details on victims or sectors in those territories.

The Secondary Market: When iOS Exploits Become Commodity

The most significant finding is strategic, not technical. Lookout explicitly notes that "there appears to be a secondary market for technically sophisticated exploit chains in which unscrupulous sellers are willing to serve buyers with little or no concern for how they will be used." Google GTIG corroborates this reading: "the use of both DarkSword and Coruna by a variety of actors demonstrates the continued risk of exploit proliferation among actors of varied geography and motivation."

The reference to Coruna is relevant as a point of comparison: it is a previous iOS exploit kit associated with the same actor UNC6353, but distinct from DarkSword. Coruna targeted older iOS versions (13–17.2.1), while DarkSword strikes the 18.x branch. The succession suggests UNC6353 has access to multiple toolkits of different provenance, or operates in an ecosystem where purchasing exploit chains has become routine. Signs of AI-assisted code and limited obfuscation in the DarkSword kit indicate, per Lookout, reduced in-house expertise on the part of the actor: the group customizes and deploys, but likely does not independently develop the exploit component.

"Notably, DarkSword appears to take a 'hit-and-run' approach by collecting and exfiltrating the targeted data from the device within seconds or at most minutes followed by cleanup." — Lookout report, reported by SecurityAffairs

The Role of AI in iOS Malware Production

Lookout's mention of code "possibly with the help of AI" introduces an element for which the dossier provides no granular technical details. No identifiable generative patterns emerge, nor do development timestamps that would allow correlating DarkSword's creation with specific AI-assisted tools. The reference remains an assessor's judgment, not a forensic finding. The implication, however, is clear: if actors with limited technical resources can customize purchased exploit chains with the aid of automated tools, the barrier between state-sponsored APTs and financially motivated cybercriminals thins further.

Why This Matters

The dossier does not specify detailed remedial measures or operational guidance from the researchers. The source does not document available patches or Apple release timelines for the affected iOS versions, although Lookout states that iOS ≥18.7.3 and iOS 26 ≥26.3 would not be vulnerable to the DarkSword chain per the original report. The brief does not list security controls, configurations, or detection tools recommended by the advisory.

On attribution, the true identity of UNC6353 remains "largely unknown" to Lookout. No infrastructure overlaps link the actor to confirmed Russian state groups at this time. The exact extent of campaigns in Saudi Arabia, Turkey, and Malaysia is not detailed: countries are targeted, but sectors, victims, and specific vectors are not declared by the source. The precise role of iVerify in the discovery triad with Lookout and Google GTIG is not articulated in the available material. The exact origin of the kit remains undetermined: developed by a third party and acquired by UNC6353, or created internally with external support.

What the dossier documents clearly is the convergence of three trends: the growing sophistication of mobile exploits, their commoditization via a secondary market, and the lowering of the barrier to offensive capabilities once exclusive. For organizations that base their mobile security posture on the assumption of iOS as a robust perimeter by default, DarkSword serves as a concrete case study on the limits of that approach.

Questions and Answers

Does DarkSword require victim interaction?

Yes. The vector is watering hole: the victim must visit a compromised website that loads the malicious iframe. It is not a zero-click attack in the strict sense, but the interaction threshold is minimal and does not require conscious installation of applications or profiles.

Which iOS versions are confirmed vulnerable?

According to SecurityAffairs, reporting Lookout/GTIG data, the range is iOS 18.4–18.7. Lookout's original report specifies versions 18.4 and 18.6.2 as verified targets. Both sources agree that versions updated to iOS 18.7.3 or later, and iOS 26.3 or later for the iOS 26 branch, are not vulnerable to the DarkSword chain.

Why is the secondary exploit market considered relevant?

Because Google GTIG has observed multiple actors using DarkSword since November 2025, including UNC6353. This proliferation indicates the kit is not exclusive to a single group but circulates as a tradable commodity, reducing the time and expertise needed to conduct full-chain attacks on iOS.

Sources

• https://securityaffairs.com/189662/hacking/darksword-emerges-as-powerful-ios-exploit-tool-in-global-attacks.html
• https://securityaffairs.com/188928/security/google-uncovers-coruna-ios-exploit-kit-targeting-ios-13-17-2-1.html
• https://www.lookout.com/threat-intelligence/article/darksword

Information is based on the cited source and current as of publication.

Sources