Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
A Chinese threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. The kit targets iOS versions 18.4 through 18.7 and has been observed to employ watering holes as a starting point …
Intelligence analysis by Llama
A Chinese threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. The kit targets iOS versions 18.4 through 18.7 and has been observed to employ watering holes as a starting point to trigger now-patched vulnerabilities in Apple's mobile operating system to execute JavaScript that ultimately fac…
Imagine you're using your iPhone to check your email, but instead of getting your email, you get a fake email that looks real. This fake email can trick your iPhone into doing something bad, like stealing your passwords or sending your personal info to someone else. This is what's happening with the DarkSword exploit kit, which is a type of malware that can trick iPhones into doing bad things.
Analysis
A $60B Vote of Confidence
The recent campaign targeting Apple iOS devices by a Chinese threat actor has raised concerns about the ongoing threat of exploit kits. The DarkSword exploit kit, which targets iOS versions 18.4 through 18.7, has been observed to employ watering holes as a starting point to trigger now-patched vulnerabilities in Apple's mobile operating system to execute JavaScript that ultimately facilitates the deployment of GHOSTBLADE, an information-stealing malware.
The use of DarkSword has since expanded in scope following a public leak of its source code, prompting other threat actors to join the exploitation bandwagon. The latest findings from Censys show that the login page for a panel called "DarkSword Admin" matches seven hosts across three countries as of July 30, 2026, in addition to a Singapore-based host running three distinct exploit-panel front ends and a Hong Kong host that bundles an Apple ID credential-harvesting decoy.
The attack flow is fairly consistent in that it begins when a victim reaches one of the operator's domains - an AWS-console impersonation subdomain or an Apple ID sign-in page - causing a malicious iframe element to load JavaScript that fires the DarkSword chain and finally deploys GHOSTBLADE modules. On successful exploitation, the implant delivers keychain, iCloud, and Wi-Fi credential-dumping modules and commences the file-exfiltration sweep.
The harvested data is then packaged and transmitted to attacker-controlled endpoints. The attacker then logs in to one of the panels, namely DarkSword Admin, Decode Dashboard, or C2 Control Panel, to extract the pilfered data.
Why Cursor?
Censys said it also discovered an open directory listing in Frankfurt that exposes the operator's tooling, including an SSH key comment "jkcing@apt," a web-content fuzzer, and references to a previously undocumented malware family referred to as Thorn C2.
The Road Ahead
The ongoing threat of exploit kits highlights the importance of keeping software up to date to prevent vulnerabilities from being exploited. Additionally, the use of watering holes as a starting point to trigger vulnerabilities in Apple's mobile operating system raises concerns about the potential for further exploitation.
Key points
- A Chinese threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit.
- The kit targets iOS versions 18.4 through 18.7 and has been observed to employ watering holes as a starting point to trigger now-patched vulnerabilities in Apple's mobile operating system to execute JavaScript that ultimately facilitates the deployment of GHOSTBLADE, an inform…
- The use of DarkSword has since expanded in scope following a public leak of its source code, prompting other threat actors to join the exploitation bandwagon.
If this development plays out positively, it could lead to increased awareness and vigilance among iPhone users, which could help prevent further exploitation. Additionally, the discovery of the DarkSword exploit kit could lead to the development of new security measures to prevent similar attacks in the future.
If this development plays out negatively, it could lead to a significant increase in the number of iPhone users who fall victim to the DarkSword exploit kit. This could result in a large-scale data breach, which could have serious consequences for individuals and organizations.
