Critical iOS Exploit Actively Targets iPhones to Steal Data

Key Takeaways

• A sophisticated iOS exploit chain, dubbed DarkSword, has been actively leveraged by commercial surveillance vendors and state-sponsored actors since November 2025 to compromise iPhones and steal sensitive data.
• DarkSword chains six vulnerabilities, including four zero-days, to achieve full device compromise on iOS versions 18.4 through 18.7.
• The exploit operates entirely in JavaScript, bypassing critical Apple security mitigations.
• Three distinct malware families (GHOSTKNIFE, GHOSTSABER, GHOSTBLADE) have been identified, each designed for specific data exfiltration and intelligence-gathering objectives.
• Apple has patched all DarkSword vulnerabilities, with the final fixes released in iOS 26.3. Users are urged to update immediately.

A highly advanced iOS exploit kit, identified as DarkSword, has been actively deployed against iPhone users by a consortium of commercial surveillance firms and government-backed threat groups. Operational since at least November 2025, this full-chain exploit is designed to illicitly acquire sensitive personal information from devices across four distinct countries.

DarkSword represents a complex full-chain exploit for iOS, integrating six separate vulnerabilities. Notably, four of these were previously unknown zero-day flaws. This sophisticated chain enables complete device compromise on iPhones running iOS versions ranging from 18.4 to 18.7.

The exploit chain’s ingenuity lies in its execution entirely within JavaScript. This method allows attackers to circumvent Apple’s robust Page Protection Layer (PPL) and Secure Page Table Monitor (SPTM), which are designed to prevent the execution of unsigned native binary code.

Through an analysis of embedded toolmarks within recovered payloads, security researchers from GTIG, iVerify, and Lookout have confirmed the exploit’s name and its deployment in targeted operations. These campaigns have impacted victims in Saudi Arabia, Turkey, Malaysia, and Ukraine.

Six-Vulnerability iOS Exploit Chain

The DarkSword exploit initiates with a remote code execution (RCE) vulnerability within JavaScriptCore, Apple’s JavaScript engine integral to Safari and WebKit. From this initial breach, it progresses through two stages of sandbox escape, followed by a local privilege escalation. The final phase involves the deployment of a payload that grants attackers full kernel-level access to the compromised device.

A critical component of this chain is CVE-2026-20700, a Pointer Authentication Code (PAC) bypass found in Apple’s dyld dynamic linker. This vulnerability was directly chained with both RCE exploits. Apple addressed this flaw in iOS 26.3, following a report from GTIG.

The full list of vulnerabilities exploited by DarkSword includes:

Post-Exploitation Malware Families

Following a successful DarkSword compromise, GTIG researchers have identified three distinct malware families deployed, each meticulously crafted to fulfill specific objectives for the various threat actors.

GHOSTKNIFE, delivered by the threat cluster UNC6748 via a deceptive Snapchat-themed phishing website (snapshare[.]chat), functions as a JavaScript backdoor. Its capabilities include exfiltrating signed-in account credentials, messages, browser data, location history, and audio recordings from the device’s microphone. This malware communicates with its command-and-control (C2) server using a proprietary binary protocol secured with ECDH and AES encryption. It actively deletes crash logs to hinder forensic analysis.

GHOSTSABER, utilized by the Turkish commercial surveillance vendor PARS Defense in operations targeting Turkey and Malaysia, boasts support for over 15 distinct C2 commands. These commands encompass device enumeration, file exfiltration, arbitrary SQLite query execution, and the uploading of photo thumbnails. Certain GHOSTSABER functionalities, such as audio recording and real-time geolocation, are not yet fully integrated into the JavaScript implant, suggesting that additional binary modules are downloaded dynamically from the C2 server during runtime.

GHOSTBLADE, attributed to UNC6353, a suspected Russian espionage group, acts as a comprehensive data miner. It is designed to exfiltrate data from iMessages, Telegram, WhatsApp, cryptocurrency wallets, Safari browsing history and cookies, Health databases, device keychains, location history, and saved Wi-Fi passwords. Unlike the other two malware families, GHOSTBLADE does not maintain persistence or support interactive backdoor commands. However, its extensive data collection capabilities make it highly valuable for intelligence-gathering operations. Intriguingly, GHOSTBLADE’s library code contains an unimplemented function named startSandworm(), which may indicate a codename for a separate, forthcoming exploit.

Delivery Mechanisms and Attribution

UNC6748 disseminated DarkSword through a fraudulent Snapchat lookalike site. Their delivery mechanism employed obfuscated JavaScript loaders, complete with anti-debugging protections and session storage fingerprinting, to prevent re-infecting the same victims.

PARS Defense subsequently enhanced its delivery method by implementing ECDH key exchange to encrypt exploit stages between its infrastructure and victim devices, indicating a heightened focus on operational security.

UNC6353, a suspected Russian espionage group previously linked to the Coruna iOS exploit kit, embedded malicious <script> tags into compromised Ukrainian websites. These tags silently loaded DarkSword via hidden iFrames. A revealing comment written in Russian found within UNC6353’s source code further supports this attribution. GTIG has been collaborating with CERT-UA to mitigate this ongoing campaign, which remained active through March 2026.

GTIG proactively reported all DarkSword vulnerabilities to Apple in late 2025. Consequently, all six CVEs have been patched, with most addressed prior to, and the remainder included in, the release of iOS 26.3. Google has also taken steps to protect users by adding all identified DarkSword delivery domains to its Safe Browsing service.

What You Should Do

• Update iOS Immediately: Ensure your iPhone is running the latest available version of iOS to apply all critical security patches.
• Enable Lockdown Mode: If an update is not immediately available or for enhanced security, enable Apple’s Lockdown Mode. This feature provides extreme, optional protection for individuals who may be targeted by sophisticated digital threats.
• Exercise Caution with Links: Be highly suspicious of unsolicited links, especially those received via messages, emails, or social media, even if they appear to come from trusted sources.
• Avoid Unknown Websites: Refrain from visiting suspicious or untrusted websites, particularly those that mimic popular services or social media platforms.
• Use a Reputable VPN: Consider using a trusted VPN service to encrypt your internet traffic, especially on public Wi-Fi networks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.