DarkSword: The iOS Kit That Armed Three Spy Groups With Six Flaws

Google Threat Intelligence Group uncovered DarkSword, a full-chain iOS exploit kit written in JavaScript that has been active since November 2025. Three distinct threat groups have adopted the framework.

On March 19, 2026, Google Threat Intelligence Group (GTIG) published its report on DarkSword, a full-chain iOS exploit kit discovered in coordination with Lookout and iVerify. The kit chains six vulnerabilities — three of them zero-days — to compromise iPhones remotely through the browser. Apple had already released patches in iOS 26.3; on April 1, 2026, it issued the backport iOS 18.7.7 for devices that cannot reach the latest major release. Three independent threat-actor groups have adopted the same framework with different payloads.

Key Takeaways

The entire exploit chain is written in JavaScript, with no compiled binaries, and chains six vulnerabilities to achieve code execution in JavaScriptCore and deploy final-stage payloads.
Three distinct malware families — GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE — were delivered by separate groups targeting different regions: Saudi Arabia, Turkey, Malaysia, and Ukraine.
Activity is documented from November 2025, with the first identified cluster (UNC6748) using a Snapchat-themed site for targeting.
Apple released patches in iOS 26.3 and a backport 18.7.7 on April 1, 2026; roughly a quarter of global iPhones were running vulnerable versions in the 18.4–18.7 range.

The JavaScript Chain That Bypasses iOS Defenses

DarkSword is designed to operate entirely in the browser. According to GTIG analysis, reported by Cyber Security 360, the exploit kit requires no app or configuration-profile download: the full chain runs through JavaScript executed in WebKit.

The mechanism is modular and versioned. GTIG recovered files with explicit naming: rce_worker_18.4.js, rce_worker_18.6.js, rce_worker_18.7.js, each containing the exploit adapted to a specific iOS build. This architecture lets operators update individual modules without rewriting the entire chain.

The six vulnerabilities cover the compromise path. GTIG documents code execution in JavaScriptCore as the entry point; the report does not publicly detail subsequent stages of the chain. Three of these flaws were zero-days at the time of discovery, unknown to Apple.

Three Groups, Three Payloads, Three Operational Theaters

The proliferation of DarkSword among independent actors follows a pattern GTIG previously observed with the Coruna kit. The difference lies in the diversity of adopters.

"DarkSword supports iOS versions 18.4 through 18.7 and utilizes six different vulnerabilities to deploy final-stage payloads" — Google Threat Intelligence Group

The first documented group, UNC6748, has been active since early November 2025. It used the site snapshare[.]chat, copying Snapchat's theme and interface, to steer victims in Saudi Arabia toward the exploit. GTIG notes that UNC6748 attempted redirects to Chrome but did not yet have a compatible chain for that browser.

PARS Defense, a Turkey-based commercial surveillance vendor, operates with high OPSEC standards. Its payload, GHOSTSABER, was detected in Turkey and Malaysia. The third actor, UNC6353, is a group GTIG suspects has a Russian connection: it previously used the Coruna kit and has now migrated to DarkSword for campaigns in Ukraine.

Each group maintains its own final payload. GHOSTKNIFE, attributed to UNC6748, is written in JavaScript. According to GTIG, it includes modules for exfiltrating various data types, including active accounts, messages, browsing data, location history, and recordings. The GTIG report uses cautious modals ("could," "may") for these capabilities, not presenting them as confirmed in every instance.

The Backport Paradox: Security Confirmed, Fragmentation Exposed

Apple fixed the vulnerabilities with the release of iOS 26.3. The installed base on 18.x versions — estimated at roughly a quarter of global iPhones — remained exposed for users who had not updated or could not due to hardware constraints.

On April 1, 2026, Apple published iOS and iPadOS 18.7.7, described as a backport for "important security protections from web attacks called DarkSword." The statement notes that the fixes associated with DarkSword were "first shipped in 2025." The advisory does not specify which of the listed CVEs are strictly part of the kit and which are independent fixes released in the same update.

This duality — rapid patch for iOS 26, delayed backport for iOS 18 — illustrates a structural tension in the Apple ecosystem. Legacy devices, often functionally adequate for users, accumulate critical delays in receiving protections against actively exploited exploits.

GTIG has added the identified delivery domains to Google's Safe Browsing database. The measure reduces the likelihood of infection on already-classified domains but does not eliminate risk on new or rotating infrastructure.

What to Do Now

Update to iOS 26.3 or, for incompatible devices, to iOS 18.7.7, available from April 1, 2026.
Verify that automatic updates are enabled: Apple indicated that iOS 18.7.7 is distributed automatically to users with the option turned on.
The GTIG report, the sole structured primary source with technical details on DarkSword, lists no specific mitigations beyond updating the operating system.

Why the iOS Exploit Market Is Changing

Editor's note: this section contains analysis based on the GTIG report, not direct evidence.

The standardization of DarkSword — a kit used by three groups with distinct payloads — suggests a maturing mobile exploit market. GTIG observed similar patterns with the Coruna kit, but DarkSword's adoption appears broader. The choice of JavaScript for the entire chain has an anti-forensic effect: it reduces binary traces on the device and simplifies adaptation to new iOS versions without recompilation.

The GTIG report of March 19, 2026 documents activity dating back to November 2025: roughly four months between first observed use and publication of the analysis. In that interval, according to GTIG analysis, at least three actors acquired and operated with the same toolkit. If confirmed by subsequent investigations, this proliferation speed would indicate that the barrier between custom-developed exploits and reusable commercial products is thinning.

The GTIG report does not rule out that other commercial surveillance vendors or threat actors are using DarkSword beyond the three documented groups.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references