DarkSword iOS 3 Zero-Days for Full Device Takeover

DarkSword is a sophisticated iOS exploit kit (full-chain remote exploit) discovered in March 2026 by researchers from Google Threat Intelligence Group (GTIG), Lookout, and iVerify. It enables attackers to achieve full device takeover on vulnerable iPhones and iPads simply by visiting a compromised or malicious website—no user interaction beyond browsing (often described as a 1-click or drive-by attack, not strictly zero-click).

It has been actively used since at least November 2025 by multiple threat actors, including suspected state-sponsored groups (e.g., UNC6353, possibly Russian-linked and previously tied to the Coruna exploit kit) and commercial surveillance vendors. Targets have included users in Ukraine, Saudi Arabia, Turkey, Malaysia, and elsewhere. A leaked version later appeared on GitHub, potentially making it easier for less sophisticated attackers to reuse.

How DarkSword Works

DarkSword is a JavaScript-based exploit chain delivered via Safari (WebContent process). It chains six vulnerabilities to escalate from initial browser access to arbitrary code execution with full kernel privileges. This allows deployment of final-stage payloads that steal data.

The three payloads observed are:

• GHOSTBLADE
• GHOSTKNIFE
• GHOSTSABER

It follows a "hit-and-run" model: quickly exfiltrate data (contacts, messages, call history, keychain credentials/passwords, crypto wallet app data, etc.) and then clean up traces, often within seconds or minutes. It specifically targets various cryptocurrency wallet apps, suggesting a mix of espionage and financial motives in different campaigns.

Vulnerabilities Exploited

The chain uses six flaws, three of which were exploited as zero-days (before Apple patched them):

• CVE-2025-31277: Memory corruption in JavaScriptCore (patched in iOS 18.6).
• CVE-2026-20700: User-mode Pointer Authentication Code (PAC) bypass in dyld (patched in iOS 26.3; used as a zero-day).
• CVE-2025-43529: Memory corruption in JavaScriptCore (patched in iOS 18.7.3 / 26.2; used as a zero-day).
• Additional flaws include CVE-2025-14174 (memory corruption in ANGLE), and kernel-related issues like CVE-2025-43510 / CVE-2025-43520.

These bypass sandboxing, Trusted Path Read-Only (TPRO), PAC protections, and other iOS security layers to reach kernel-level access. The exploit primarily targeted iOS 18.4 through 18.7 (with config data noted up to 18.6.2 in some samples). Some patches rolled out earlier in the iOS 18.x series, with fuller coverage in iOS 26.x releases.

Risk and Impact

Hundreds of millions of devices were potentially affected at the time of discovery, as a notable percentage of iPhones remained on iOS 18.x variants. The leak of exploit code has raised concerns about broader reuse, including by cybercriminals. Attacks were delivered through compromised legitimate websites (watering hole style) rather than purely targeted links in all cases.

Apple has patched the underlying vulnerabilities in subsequent updates (notably iOS 26.3 and related 18.x security updates). There is no evidence of ongoing exploitation against fully patched modern iOS versions (iOS 26+), though researchers note they cannot completely rule it out for unpatched older devices.

What You Should Do (Recommendations)

• Update immediately: Go to Settings > General > Software Update and install the latest iOS version available for your device. This is the most effective mitigation, as the known chain does not work on patched versions.
• If you cannot update (e.g., older hardware), enable Lockdown Mode (Settings > Privacy & Security > Lockdown Mode). This significantly hardens the device against such browser-based exploits, though it may limit some functionality.
• Be cautious with links and websites, especially if you suspect targeted activity (e.g., high-risk regions or profiles). Avoid visiting suspicious sites.
• For high-security needs, consider additional mobile threat defense tools, though Apple's built-in protections + timely updates remain the primary defense.

This exploit highlights the ongoing arms race in mobile security: even "secure" platforms like iOS face advanced full-chain attacks from well-resourced actors, often proliferated across groups. Similar to the earlier Coruna kit, it shows how exploit chains can be shared or sold in underground/commercial markets.

If your device is on an older iOS 18.x version or you're concerned about potential past exposure, updating is the priority. For the most detailed technical breakdowns, refer to the reports from Google GTIG, Lookout, and iVerify. Stay safe—keep your software current!