Researchers Disclose DarkSword iOS Exploit Kit

Security researchers from Google, Lookout, and iVerify have disclosed the existence of DarkSword, a sophisticated iOS exploit kit that has been used since November 2025 to compromise iPhones through zero-day vulnerabilities. The toolkit enables attackers to gain remote code execution and steal sensitive data from unpatched devices, prompting Apple to urge users on older iOS versions to update immediately for protection.

DarkSword chains six vulnerabilities, including three in the WebKit browser engine, two in the iOS kernel, and one in the Dynamic Link Editor. It begins with a malicious iframe embedded in compromised websites, such as a fake Snapchat page targeting Saudi Arabian users or altered Ukrainian government and news sites aimed at individuals in Ukraine. Once triggered in Safari, the exploit breaks out of the WebContent sandbox, injects code via WebGPU, and achieves kernel-level access to bypass restrictions. This allows deployment of payloads like GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER, which collect data including passwords, encryption keys, emails, photos, cryptocurrency wallets, location history, and Safari browsing records before exfiltrating it to...