7 Critical Facts About the DarkSword iOS Exploit Chain

In the ever-evolving landscape of mobile security, a new threat has emerged that targets Apple's iOS devices with alarming precision. Known as DarkSword, this sophisticated exploit chain leverages multiple zero-day vulnerabilities to gain full control over iPhones and iPads. Discovered by Google's Threat Intelligence Group (GTIG), DarkSword has already been deployed by state-sponsored actors and commercial surveillance vendors across several countries. Here's what you need to know about this advanced malware, how it works, and how to protect yourself.

1. DarkSword Is a Full-Chain iOS Exploit, Not Just a Single Piece of Malware

Unlike typical malware that infects through a single vulnerability, DarkSword is a full-chain exploit—a series of exploits that chain together to compromise an iOS device from initial entry to final payload execution. GTIG identified at least six different zero-day vulnerabilities exploited in sequence, allowing the attackers to bypass Apple's layered security defenses. This kind of multi-stage attack requires deep knowledge of iOS internals and significant resources, leading researchers to believe it was developed by a government-level entity or a well-funded offensive cyber firm.

The exploit chain targets devices running iOS versions 18.4 through 18.7, which means millions of users were potentially at risk before patches were released. The goal of DarkSword is not just to steal data but to establish persistent access, essentially giving the attacker full remote control over the device—much like a jailbreak but without the user's knowledge.

2. It Was Discovered by Google's Threat Intelligence Group (GTIG)

Google's internal security research team, the Threat Intelligence Group (GTIG), detected DarkSword while monitoring advanced persistent threats. Through toolmarks and code analysis in recovered payloads, they connected the exploit chain to a name used by the attackers themselves: DarkSword. GTIG has been tracking this since at least November 2025, and their findings were initially shared with Apple to facilitate patching.

The discovery highlights the growing collaboration between industry rivals—Google and Apple—to protect users from state-sponsored threats. GTIG's report details how DarkSword is being used by multiple distinct threat actors, indicating that the exploit chain may have been sold or shared among different groups, much like the previously known Coruna iOS exploit kit.

3. DarkSword Exploited Six Zero-Day Vulnerabilities

The exploit chain leverages six zero-day vulnerabilities in iOS, each discovered and exploited before Apple had a chance to release a patch. These vulnerabilities spanned multiple components, including the kernel, WebKit, and system services. By chaining them together, the attackers could achieve code execution with full system privileges without any user interaction—a so-called "zero-click" exploit.

Apple has since released updates for all six vulnerabilities, but only users who applied the patches quickly were protected. The specific CVE identifiers were not publicly disclosed to prevent copycat attacks, but GTIG noted that the complexity of the exploit chain indicates a high level of sophistication. Defenders should ensure all devices are updated to at least iOS 18.8 or later, where these flaws were addressed.

4. Three Distinct Malware Families Are Deployed After Exploitation

Once DarkSword successfully compromises a device, it installs one of three payload families: GHOSTBLADE, GHOSTKNIFE, or GHOSTSABER. Each serves a different purpose, and GTIG believes the choice depends on the threat actor's operational needs:

• GHOSTBLADE: A persistent backdoor that exfiltrates messages, call logs, and live microphone feeds.
• GHOSTKNIFE: A data-stealing module focused on encrypted messaging apps like WhatsApp and Signal.
• GHOSTSABER: A remote surveillance tool that can activate the camera and GPS at will.

These payloads are modular, allowing the attacker to customize the espionage campaign. All three communicate with command-and-control servers using encrypted channels, making detection difficult for traditional antivirus software.

5. DarkSword Has Been Used Against Targets in Multiple Countries

Since November 2025, GTIG observed DarkSword being deployed in campaigns targeting individuals in Saudi Arabia, Turkey, Malaysia, and Ukraine. The victims appear to be high-value individuals: journalists, dissidents, government officials, and military personnel. The geographic spread suggests the exploit chain is either being sold to multiple customers or shared among allied nation-states.

Of particular note is the group UNC6353, a suspected Russian espionage team previously linked to the Coruna exploit kit. UNC6353 has now incorporated DarkSword into their watering hole campaigns—where they compromise websites frequently visited by targets and serve the exploit through malicious ads or drive-by downloads. This makes detection even harder because the victim doesn't need to click a malicious link; simply visiting a compromised site installs the malware.

6. A Week After Discovery, a Version of DarkSword Leaked Online

Just one week after GTIG identified and reported DarkSword, a version of the exploit chain was leaked onto the internet. The source of the leak remains unknown, but its impact was immediate. Previously limited to state-sponsored groups, the exploit chain became accessible to a wider range of cybercriminals, including those with less technical expertise.

This leak dramatically increased the threat surface. While the most sophisticated actors were already using DarkSword, the leak allowed lower-tier hackers to purchase or download the exploit and integrate it into their own toolkits. Security experts warned that this could lead to a surge in targeted attacks against iOS users worldwide, especially if the leaked version still worked on unpatched devices.

7. Regular Patching Is Your Best Defense—and You're Safe If Updated

By the time this article was prepared, Apple had released security updates addressing all six zero-day vulnerabilities exploited by DarkSword. Users who promptly updated to iOS 18.8 or later are no longer at risk from this specific exploit chain. However, the broader threat from similar attacks remains. The best protection is a rigorous patching routine: enable automatic updates and apply them as soon as they become available.

Additionally, avoid visiting untrusted websites, especially those that may be used in watering hole attacks. Use Lockdown Mode if you believe you are at a high risk of targeted surveillance. For most users, modern iOS security features combined with timely updates provide robust defense. But as the DarkSword case shows, even the most secure platforms can be compromised by well-funded adversaries—so vigilance is key.

Conclusion

DarkSword represents a worrying escalation in iOS exploitation, demonstrating that even Apple's walled garden can be breached by determined attackers. The involvement of nation-state actors and the subsequent leak of the exploit chain highlight the challenges in securing mobile devices. However, for the average user, the risk is low if you keep your device updated. As we move into 2026, expect more such discoveries—and more pressure on Apple to further harden iOS against full-chain attacks.