A powerful iPhone exploit kit called DarkSword was publicly disclosed on 18 March 2026 by Lookout, Google’s Threat Intelligence Group (GTIG), and iVerify. The three firms published coordinated analyses after DarkSword was found being used in active watering-hole attacks against iPhone users in Ukraine, Saudi Arabia, Turkey, and Malaysia. According to iVerify’s estimates, between 221 million and 296 million iPhones may still be running the iOS versions that DarkSword targets.
DarkSword was discovered by Lookout while investigating the infrastructure linked to a separate iOS exploit kit called Coruna, disclosed earlier in March 2026. Researchers found DarkSword hosted on the same servers, but confirmed it is an entirely different tool built by different developers. It chains six separate software vulnerabilities — four of which were exploited as zero-days — to silently steal data from any iPhone running iOS 18.4 through iOS 18.7 that visits a compromised website. No taps, no downloads, no warning. For more context on how AI tools are reshaping the cybersecurity landscape in 2026, the connection runs deeper than most users realise.
Your iPhone Could Be
Hacked Just by Browsing
DarkSword silently steals your data the moment you visit a compromised website — no clicks, no downloads, no trace left behind. Check your iOS version below.
A Hit-and-Run Attack That Leaves No Trace
This section explains what DarkSword is, how it was found, and why it is different from typical spyware.
DarkSword is a full-chain iOS exploit kit written entirely in JavaScript. It was discovered by Lookout’s Threat Labs while their researchers were mapping infrastructure linked to the earlier Coruna exploit. GTIG at Google and iVerify then joined the investigation for a broader analysis. All three published their findings together on 18 March 2026.
What makes DarkSword particularly difficult to detect is its “hit-and-run” design. Once it finishes pulling data from a device, it deletes crash logs and all evidence of its presence — no app installed, no notification, no trace in diagnostic reports. The attack runs entirely through the Safari browser using legitimate iOS system processes, rather than installing a persistent implant.
“A vast number of iOS users could have all of their personal data stolen simply for visiting a popular website.”
— Rocky Cole, Co-founder & COO, iVerifyResearchers also noted that the Russian-linked group using DarkSword against Ukraine left the exploit’s full source code — with English-language comments explaining each component and the “DarkSword” label — openly accessible on compromised servers. That operational carelessness is how researchers were able to fully analyse and name the tool. For the latest on Apple hardware and software in 2026, Apple has confirmed all DarkSword vulnerabilities are patched in iOS 26.3 and above.
Six Exploits, One Seamless Strike
Walk through DarkSword’s exact attack sequence — from the moment you visit a page to the moment your data is gone.
A malicious iframe is silently injected into otherwise legitimate sites — Ukrainian news outlets, a government appeals court site, or a fake Snapchat-themed page (snapshare[.]chat used for Saudi Arabia targets). The iframe loads without any visible indication.
A JavaScript loader (rce_loader.js) runs, identifies your iOS version, and fetches the correct exploit variant for your device — ensuring the right CVE is used for your specific iOS build.
For iOS below 18.6: CVE-2025-31277 (JIT type confusion bug) is used. For iOS 18.6–18.7: CVE-2025-43529 (garbage collection bug in DFG JIT layer) is used. Both create arbitrary memory read/write access inside Safari’s renderer process.
A bug in dyld — Apple’s dynamic linker — bypasses Pointer Authentication Codes (PAC) and Trusted Path Read-Only (TPRO) protections. This allows arbitrary code execution inside WebContent. This was a zero-day, patched only with iOS 26.3.
An out-of-bounds write in ANGLE (WebGL graphics layer, CVE-2025-14174) escapes the WebContent sandbox into the GPU process. A copy-on-write bug in the XNU kernel (CVE-2025-43510) then pivots into mediaplaybackd — a system daemon with far greater permissions.
A final kernel memory corruption bug (CVE-2025-43520) grants full kernel read/write. The orchestrator (pe_main.js) loads data-stealing modules, exfiltrates all collected data over ECDH+AES-encrypted HTTP connections, then deletes crash logs and all traces of itself.
The CVEs Behind DarkSword
All six have been patched. Three were zero-days when DarkSword was actively using them. Update to iOS 26.3.1 or iOS 18.7.6 to be fully protected against the observed variants.
| CVE ID | Component & Bug Type | Patched In |
|---|---|---|
| CVE-2025-31277 | JavaScriptCore — JIT type confusion (iOS < 18.6) | iOS 18.6 |
| CVE-2025-43529 | JavaScriptCore — DFG JIT garbage collection bug (iOS 18.6–18.7)0-DAY | iOS 18.7.3 / 26.2 |
| CVE-2026-20700 | dyld — User-mode PAC bypass0-DAY | iOS 26.3 only |
| CVE-2025-14174 | ANGLE (WebGL) — Out-of-bounds write, GPU sandbox escape0-DAY | iOS 18.7.3 / 26.2 |
| CVE-2025-43510 | XNU kernel — Copy-on-write memory management bug | iOS 18.7.2 / 26.1 |
| CVE-2025-43520 | XNU kernel — Memory corruption, privilege escalation | iOS 18.7.2 / 26.1 |
GHOSTBLADE · GHOSTKNIFE · GHOSTSABER
Each threat actor who used DarkSword deployed a different final malware payload. Tap each one to see what it does and who used it. This is key to understanding who was targeted and why.
What DarkSword Takes From Your Phone
Tap each category below to see exactly what the exploit targets. This list is drawn from the forensic file list (FORENSIC_FILES variable) found inside DarkSword’s own code by iVerify.
Where DarkSword Was Used
Tap each country to see which threat actor was responsible, which malware payload was deployed, and the timeline of attacks. Source: Google GTIG blog.
From First Use to Public Disclosure
A chronological account of when DarkSword was first used, how it spread across actors, and when patches and disclosures happened.
Who Used DarkSword
Three separate threat actor groups used DarkSword — each with different delivery methods, different targets, and different final payloads. Who built DarkSword remains unknown.
Google’s GTIG attributed DarkSword campaigns to three actors. UNC6353 is a suspected Russian espionage group that also used the Coruna exploit kit. It ran watering-hole attacks on Ukrainian websites from December 2025 through March 2026, deploying GHOSTBLADE. UNC6748 used DarkSword in Saudi Arabia in early November 2025 via a fake Snapchat site, deploying GHOSTKNIFE. PARS Defense, a Turkish commercial surveillance vendor, and one of its customers used DarkSword in Turkey (November 2025) and Malaysia (January 2026), deploying GHOSTSABER.
Who created DarkSword is not known. Researchers noted the tool is entirely separate from Coruna, built by different developers. The English-language comments in DarkSword’s code — likely written to help a customer understand the tooling — suggest it passed through a commercial broker. Lookout and iVerify also found signs that large language models were used to assist in writing parts of the codebase, a pattern also seen in Coruna.
“Your experienced Russian threat actors — your APT29s of the world — I would expect them to have better OPSEC.”
— Justin Albrecht, Global Director of Mobile Threat Intelligence, LookoutDespite its sophisticated exploit chain, the operational security around DarkSword’s deployment was poor. UNC6353 left full, unobfuscated source code on the same servers used to deliver the exploit. Google added all identified delivery domains to Safe Browsing after disclosure, blocking them in Safari.
Your iPhone Protection Checklist
Tick each step as you complete it. Apple confirmed that devices running iOS 26.3.1 or iOS 18.7.6 are not affected by the observed DarkSword variants.
The Exploit Has Been Covered. Your Next Step Is Clear.
The DarkSword iOS exploit kit was discussed above in detail — how it works, which six CVEs it chains, who used it, what data it targets, and where it was deployed. Lookout, Google’s GTIG, and iVerify published their joint findings on 18 March 2026. Apple has confirmed all six vulnerabilities are patched in iOS 26.3. Devices on iOS 26.3.1 or iOS 18.7.6 are not affected by the observed variants.
Keeping software up to date on Apple devices was described by Apple as the single most important step users can take. For those interested in how technology, AI, and security intersect in 2026, our coverage of AI-driven hardware advances and AI in large-scale live events covers these themes further. The full technical analysis from Google GTIG and the iVerify breakdown are available for those who want deeper reading.
