A new iPhone exploit kit known as DarkSword is raising concerns among security researchers who say the nation-state sophistication of the tool coupled with its commercial availability marks a troubling new trend among garden variety cybercriminals.
Documented by researchers at Google Threat Intelligence Group (GTIG), Lookout and iVerify, DarkSword enables attackers to quietly extract sensitive data from iPhones running specific, unpatched versions of iOS 18 – primarily between iOS 18.4 and 18.7. The attack, sometimes referred to as a zero-click, only requires a victim to be lured to a compromised website.
Apple has since patched the group of vulnerabilities chained together to execute the attack. Researchers advise users to update to the latest version of iOS, which is not vulnerable to the DarkSword technique.
In a statement to media, Apple said it had already fixed the flaws underlying the exploit chain. “We have addressed the underlying vulnerabilities in iOS and continue to encourage customers to install the latest software updates to protect their devices,” an Apple spokesperson told The Verge.
DarkSword, researchers note, underscores a growing convergence between nation-state spyware, commercial surveillance vendors and financially motivated cybercrime. What was once the exclusive domain of elite intelligence services is now being used by a broader mix of actors.
Google Threat Intelligence Group (GTIG) said it has tracked DarkSword since at least November 2025, linking it to multiple commercial surveillance vendors and at least three distinct threat clusters, including a Saudi-linked group (UNC6748), customers of Turkish surveillance firm PARS Defense, and a suspected Russian espionage actor (UNC6353) operating in Ukraine. The campaigns span four countries – Ukraine, Saudi Arabia, Turkey and Malaysia – and leverage at least three payload families (GHOSTKNIFE, GHOSTSABER and GHOSTBLADE), suggesting the exploit is being reused and adapted rather than deployed as a one-off tool.
Lookout researchers add that the same campaigns show dual-use behavior, targeting both individuals of intelligence interest and high-value assets such as cryptocurrency wallets and financial data, pointing to actors who blend espionage with profit-driven motives.
That evolution and the speed at which tools like this are moving between operators is already visible in the data. Google Threat Intelligence Group said it has tracked DarkSword across multiple threat clusters and commercial surveillance customers in four countries, suggesting the exploit is being reused and adapted rather than tightly controlled.
A Quiet Compromise
In practice, DarkSword behaves less like traditional spyware and more like state-sponsored toolkits or gray market commercial spyware.
Victims are typically exposed through compromised legitimate websites, or watering holes. In cases analyzed by researchers, attackers injected malicious code into regional news and government-related sites, silently redirecting visitors to exploit infrastructure.
From there, DarkSword attacks unfold automatically – no download or prompt.
Lookout researchers describe it as a “hit-and-run” operation. The malware quickly collects data such as credentials, messages, photos, browser history, notes, calendars and even cryptocurrency wallet information.
Technically, the attack runs entirely in memory using JavaScript, meaning it doesn’t install a traditional app or leave files behind on the device. After a user visits a compromised website, the exploit chain triggers inside Safari, executes malicious code, then breaks out of Apple’s browser sandbox and gains elevated system access. From there, it injects code into trusted iOS processes – such as system services responsible for networking and security – to quietly access sensitive data.
Once the data is gathered and transmitted to attacker-controlled servers, the code cleans up and terminates. The entire process can take just minutes and leaves little trace, making detection and forensic analysis significantly more difficult.
Breaking into the iPhone
While the attack is technically complex, it’s conceptually straightforward.
DarkSword chains together multiple vulnerabilities to move from a webpage to full device access. It begins by exploiting Safari to execute code, then escapes Apple’s sandbox protections, escalates privileges and ultimately reaches system-level processes that can access sensitive data.
Researchers said the chain relies on six previously disclosed iOS vulnerabilities (CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520) affecting WebKit (Safari), the iOS sandbox and core system services. While not all CVE identifiers were publicly detailed in the research, the flaws fall into three key categories:
- WebKit remote code execution flaws that allow malicious websites to run code in Safari
- Sandbox escape vulnerabilities that let attackers break out of browser restrictions
- Kernel and privilege escalation bugs that grant deeper system access
According to Google Threat Intelligence Group, the vulnerabilities were actively exploited before being patched and were addressed across multiple iOS updates throughout late 2025 and early 2026.
Researchers at iVerify said the version they recovered included a complete one-click exploit chain written in JavaScript, capable of navigating these steps in sequence before deploying in-memory tools that extract and transmit data.
Google observed related variants extending support through later iOS 18 versions, reinforcing that the framework is being actively adapted.
Three Perspectives, One Ecosystem
Google Threat Intelligence Group, Lookout and iVerify each approached DarkSword from different angles; tracking its global use, analyzing its behavior on devices and reverse-engineering its inner workings.
iVerify provided the deepest technical dive. The company traced delivery to compromised Ukrainian websites that loaded malicious iframes from attacker-controlled servers, then served exploit code tailored to specific targets. Researchers found Russian-language comments in early stages of the code and English-language debugging notes in later ones, along with reusable components that made it possible to reconstruct the exploit in a lab environment.
That level of accessibility hints at something larger: the possibility that DarkSword was built not just for use, but for distribution.
A Growing Market for Exploits
All three takes on DarkSword point to an emerging marketplace for advanced mobile exploits.
Lookout notes that DarkSword follows closely behind earlier chains such as Coruna, reinforcing evidence that sophisticated iPhone exploits are no longer tightly held assets. Instead, they are increasingly bought, sold or shared among actors with varying levels of technical skill.
Google’s tracking shows how quickly such tools can spread across regions and missions. And iVerify’s ability to reconstruct the exploit suggests the underlying code may not be heavily protected from reuse.
The result is a shift from bespoke, high-cost espionage tools to something closer to a reusable hacking framework. This framework, they say is one that can be adapted for surveillance, financial theft or both.
Patch, Update, Repeat
Despite its sophistication, DarkSword relies on known vulnerabilities that have now been fixed.
Security experts recommend updating immediately and enabling Apple’s Lockdown Mode for users at higher risk of targeted attacks.
So far, DarkSword campaigns have focused outside the United States. But researchers say there is nothing in the exploit itself that limits where it can be used.
It is a sign that iPhone exploitation, once rare, expensive and tightly controlled, is becoming more accessible and more adaptable. The tools are evolving. The actors are diversifying. And the gap between high-end espionage and everyday cybercrime is narrowing.
DarkSword may not be the last of its kind. It may be the beginning of a new phase, notes researchers.
