DarkSword iOS Exploit Kit Spreads to 180 Websites and 27 Hosts

Key Takeaways

• The DarkSword iOS exploit kit has significantly expanded its malicious infrastructure, now spanning 180 web properties and 27 hosts.
• This campaign specifically targets iPhones running iOS versions 18.4 through 18.7.
• The exploit kit leverages a six-vulnerability chain to bypass security measures and deploy GHOSTBLADE modules for extensive data exfiltration, including keychain, iCloud, and Wi-Fi credentials.
• Attackers are rapidly rotating infrastructure, replacing servers within days while maintaining consistent malicious content.
• Users are urged to update their iOS devices immediately and consider using Lockdown Mode to enhance protection against these highly targeted attacks.

DarkSword iOS Exploit Kit Expands Malicious Reach Across 180 Websites

The DarkSword iOS exploit kit, originating from a publicly leaked exploit chain, has evolved into a sophisticated and dynamic network of malicious web infrastructure. This campaign primarily targets iPhones operating on iOS versions 18.4 to 18.7, aiming to exfiltrate highly sensitive user data after victims are lured to compromised websites.

The attack sequence is initiated when a user visits a deceptive website, which could be a fake sign-in portal, an iOS-themed page, or a compromised legitimate site. These sites surreptitiously load the exploit chain through hidden content. Once activated, DarkSword can circumvent iOS security protocols, gain access to device data, and then deploy GHOSTBLADE modules designed to harvest critical information such as keychain data, iCloud credentials, Wi-Fi passwords, and other sensitive files.

Infrastructure and Evasion Tactics

Researchers at Censys have been actively monitoring the growth of this infrastructure. Their analysis highlights the attackers’ agility in rapidly changing hosts and domains while retaining consistent web-page fingerprints. This tactic allows the operators to replace compromised servers within days, making traditional domain or IP-based blocking less effective, as Censys said in a report shared with Cyber Security News (CSN).

As of July 30, 2026, Censys observed 27 distinct hosts and 180 web properties associated with DarkSword. However, researchers emphasize that these numbers represent a fluid snapshot, continuously changing as the attackers adapt their infrastructure.

The DarkSword exploit kit is built upon a six-vulnerability chain, initially exposed via the ghh-jbDarkSword GitHub repository. This chain facilitates a browser-based attack flow, escalating from an initial web visit to deep device access, consistent with previous DarkSword attacks against high-value iPhone users. The malicious infrastructure observed includes fabricated AWS console pages and Apple ID credential-harvesting pages, alongside other ephemeral lure fronts. A notable example involved a Hong Kong server (103.106.190.217) simultaneously hosting an Apple-themed sign-in decoy and DarkSword staging content, demonstrating a combined approach to credential theft and exploit delivery on a single system.

To track the operation more effectively, researchers rely on stable page-body hashes rather than volatile domains. For instance, a DarkSword Admin panel hash was identified on seven hosts across Hong Kong, Japan, and the United States, even as five of these hosts changed within a week. The attackers also exposed several operator panels on non-standard ports, including 3000, 8443, and 8888. A specific pattern of five open ports was found on three Hong Kong Decode Dashboard hosts, while one Singapore host previously ran DarkSword concurrently with Coruna, an older iOS exploit framework.

Lures, Data Theft, and Defense

Upon landing on a malicious DarkSword page, victims are served a staging page that covertly loads a hidden iframe. This iframe then delivers exploit code specifically tailored to the victim’s iOS version. If the exploit succeeds, the GHOSTBLADE modules initiate data collection, targeting credentials, iCloud data, stored Wi-Fi passwords, and other files, which are then transmitted to attacker-controlled collection endpoints.

To hinder forensic analysis, the operators attempt to erase traces of their activity by deleting crash reports and the `RemoteLog.log` file before exiting. The Apple ID credential-harvesting decoy is particularly effective as it directly captures user credentials, mirroring the social engineering tactics seen in sophisticated Apple ID phishing campaigns.

What You Should Do

• Update iOS Immediately: Ensure your iPhone is running the latest available iOS version to patch known vulnerabilities.
• Enable Lockdown Mode: If immediate updates are not possible or if you are a high-risk individual, activate Apple’s Lockdown Mode for enhanced protection against targeted browser-based exploits.
• Exercise Caution with Links: Be highly suspicious of unexpected sign-in pages or unsolicited links, especially those mimicking legitimate services like Apple ID or AWS.
• Monitor Network Activity: For defenders, prioritize hunting for stable page-body hashes and the specific five-port Decode Dashboard pattern (8000, 8881, 8882, 8888, 9999, scoped to Hong Kong AS135357) rather than relying solely on ephemeral domain or IP blocklists.
• Frequent Infrastructure Scans: Due to the rapid rotation of DarkSword hosts and web properties, security teams should conduct DarkSword exposure searches at least weekly.
• Review IoCs: Utilize the provided Indicators of Compromise (IoCs) within controlled threat intelligence platforms (e.g., MISP, VirusTotal, SIEM) for proactive detection and blocking. Note that IP addresses and domains are intentionally defanged (e.g., `[.]`) to prevent accidental resolution or hyperlinking; re-fang only within secure environments.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.