BlogDarkSword: The New iOS Zero-Day Exploit Chain Adopted by Multiple Threat Actors

Overview

In mid-March 2026, Google’s Threat Intelligence Group (GTIG) published a detailed report on a full iOS exploit chain named DarkSword, a name derived from toolmarks found in recovered payloads. The chain lets an attacker fully compromise an iPhone simply by luring a victim to a malicious web page — no app installation or file download required.

What stands out most in the report isn’t the technical sophistication of the exploits themselves, but how widely they have spread. Since at least November 2025, GTIG has tracked multiple, entirely independent parties using DarkSword — ranging from commercial surveillance vendors to suspected state-sponsored espionage groups. These campaigns have targeted users in Saudi Arabia, Turkey, Malaysia, and Ukraine.

DarkSword works against iOS versions 18.4 through 18.7 and chains together six distinct vulnerabilities to deliver a final payload with full kernel privileges. GTIG identified three separate malware families deployed after a successful compromise: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. The fact that a single exploit chain has been picked up by so many unrelated actors mirrors an earlier case involving another iOS exploit kit known as Coruna.

All of the underlying vulnerabilities were reported to Apple by GTIG in late 2025 and were patched by the release of iOS 26.3 (most were fixed even earlier). Google has also added the domains used to deliver DarkSword to Safe Browsing, and strongly encourages users to update to the latest iOS version; where an immediate update isn’t possible, enabling Lockdown Mode is recommended for extra protection. The research was carried out in coordination with industry partners Lookout and iVerify.

Discovery Timeline

GTIG has traced multiple distinct users of DarkSword back to November 2025, and assesses that other commercial surveillance vendors or threat actors may also be quietly using it without having been detected yet.

Saudi Arabian users targeted through a fake Snapchat site (UNC6748)

In early November 2025, GTIG identified a cluster tracked as UNC6748 using a Snapchat-themed decoy website to target Saudi Arabian users. The landing page ran obfuscated JavaScript that created a hidden IFrame to fetch the next delivery stage, and set a session-storage flag to avoid re-infecting the same victim twice. After the exploit ran, victims were redirected to the real Snapchat website to mask what had happened.

Over multiple observations throughout November 2025, GTIG watched UNC6748 repeatedly update its infrastructure — starting with support for a single remote-code-execution (RCE) exploit (built on CVE-2025-31277 in JavaScriptCore, paired with CVE-2026-20700, a Pointer Authentication Code bypass in dyld), and later adding support for iOS 18.6 and 18.7 (built on CVE-2025-43529). Notably, some of the code shipped with logic bugs in how it detected the victim’s iOS version, suggesting parts of it may have been written well before UNC6748 acquired and deployed it. The final payload UNC6748 delivered was a backdoor tracked as GHOSTKNIFE.

PARS Defense: campaigns in Turkey and Malaysia

In late November 2025, GTIG observed the Turkish commercial surveillance vendor PARS Defense using DarkSword against domestic targets, with full support for iOS 18.4–18.7. Compared to UNC6748, this campaign showed noticeably stronger operational security: the exploit loader and several stages were more heavily obfuscated, and traffic between server and victim was encrypted using ECDH and AES.

By January 2026, GTIG spotted a different PARS Defense customer running a similar campaign against users in Malaysia, using a loader with additional device-fingerprinting checks. Where samples were recoverable, the final payload in this activity was a different backdoor, GHOSTSABER.

UNC6353’s new Ukrainian watering-hole campaign

GTIG also observed the suspected Russian espionage actor UNC6353 — previously known for watering-hole attacks on Ukrainian websites since summer 2025 to deliver the Coruna exploit kit — shifting to DarkSword. This activity remained active through March 2026 with roots dating back to at least December 2025, deploying the malware family GHOSTBLADE. GTIG notified and worked with CERT-UA to help mitigate the campaign.

Compromised Ukrainian websites were injected with a malicious script that pulled in the first delivery stage from a UNC6353-controlled server. Interestingly, the source code included a Russian-language comment suggesting the developer wasn’t fully sure whether a session-check mechanism inherited from the DarkSword codebase was actually needed — a detail hinting that much of DarkSword’s underlying framework is reused nearly as-is across different “customers,” each only tweaking small pieces for their own operational needs.

Inside the DarkSword Exploit Chain

DarkSword chains together six separate vulnerabilities to go from code execution inside a browser tab all the way to full kernel control. Unlike Coruna, DarkSword only supports a narrower range of iOS versions (18.4–18.7), and while the individual exploits are technically sophisticated, the loading and staging mechanism is simpler and less robust than Coruna’s. A key architectural difference is that DarkSword is written entirely in JavaScript across every stage, which lets the attackers avoid having to bypass Apple’s low-level memory protections — Page Protection Layer (PPL) and Secure Page Table Monitor (SPTM) — that are designed to block unsigned native code from running.

The six vulnerabilities used are:

The chain runs through four broad stages:

1. Remote code execution via JavaScriptCore: Depending on the victim’s iOS version, DarkSword exploits either CVE-2025-31277 (pre-18.6) or CVE-2025-43529 (18.6–18.7) to gain arbitrary code execution inside Safari, and every version of the chain then follows up with CVE-2026-20700 to bypass user-mode PAC protections.
2. Escaping the WebContent sandbox: Safari isolates the process that renders untrusted web content (WebContent) inside a tight sandbox. DarkSword uses CVE-2025-14174 — insufficient parameter validation in a WebGL operation in ANGLE — to pivot from the WebContent sandbox into Safari’s GPU process.
3. Escaping the GPU sandbox: From the GPU process, which still has restricted access, DarkSword exploits CVE-2025-43510, a copy-on-write bug in the XNU kernel, to build arbitrary function-call capability inside mediaplaybackd, a system service with far broader privileges than Safari’s GPU process.
4. Local privilege escalation: Finally, the chain loads an exploit for CVE-2025-43520, a race condition in XNU’s virtual filesystem layer, to build physical and virtual memory read/write primitives — giving the attacker full kernel privileges to deploy the final payload.

Three Post-Exploitation Malware Families

GHOSTKNIFE (used by UNC6748) is a JavaScript backdoor with modules for exfiltrating signed-in accounts, messages, browser data, location history, and audio recordings. It can also download files from its command-and-control (C2) server, take screenshots, and record from the device microphone. It communicates over a custom binary protocol on HTTP encrypted with ECDH and AES, and periodically wipes crash logs to cover its tracks.

GHOSTSABER (used by PARS Defense) is also a JavaScript backdoor that talks to its C2 over HTTP(S), supporting device/account enumeration, file listing, data exfiltration, and arbitrary JavaScript execution. Notably, several built-in commands — such as microphone recording and sending device geolocation — currently lack the code needed to actually run, suggesting GTIG’s assessment that a follow-on binary module may be downloaded later to complete these features.

GHOSTBLADE (used by UNC6353) is a broad-scope data collection tool: it can pull iMessage, Telegram, and WhatsApp data, contacts, location history, saved WiFi networks, device keychains, photos (including hidden ones), Notes, Calendar entries, cryptocurrency wallet data, Safari history, health data, and a list of installed apps. Unlike the other two backdoors, GHOSTBLADE doesn’t run continuously or support additional modules — it performs a one-time data grab and exits. GTIG assesses that GHOSTBLADE was likely built by the DarkSword developers themselves, based on coding-style consistency and how tightly it’s integrated with the exploit chain’s core libraries.

Comparison With Coruna and Broader Implications

The fact that both DarkSword and Coruna have ended up in the hands of multiple, unrelated actors — spanning different countries and motivations — illustrates the growing risk of exploit proliferation across the commercial spyware industry. Once a complete zero-day chain exists, it can be sold, shared, or leaked to very different customers, making attribution and mitigation far harder.

Google says it remains committed to helping address this problem, including through its ongoing participation in the Pall Mall Process, an international initiative aimed at building consensus to curb the harms caused by the commercial spyware industry — building on earlier steps taken by the U.S. government and other international commitments to limit misuse of these tools and protect human rights.

Security Recommendations

• Update iOS immediately to the latest available version (iOS 26.3 or later), since all six DarkSword vulnerabilities have now been patched.
• High-risk individuals — journalists, human-rights defenders, government officials, and similar — who can’t update right away should enable Lockdown Mode to substantially reduce their attack surface.
• Be cautious of unfamiliar links, especially sites impersonating well-known brands (as in the fake Snapchat case) sent via messaging apps or social media.
• Enterprise security teams should reference the indicators of compromise and YARA detection rules published alongside GTIG’s original report to scan their environments.

Indicators of Compromise and Detection

GTIG published a full set of network indicators tied to all three threat clusters (domains and C2 IP addresses for UNC6748, PARS Defense, and UNC6353), uploaded an extracted GHOSTBLADE sample to VirusTotal, and released four YARA rules for detecting GHOSTKNIFE, GHOSTSABER, GHOSTBLADE, and shared library file-path artifacts across the exploit chain. Security teams should consult GTIG’s original report and its associated VirusTotal collection directly for the exact indicators and rule syntax needed for monitoring.

Conclusion

DarkSword is the latest evidence that the commercial spyware ecosystem is evolving at an alarming pace and scale: a single zero-day exploit chain can quickly spread to multiple unrelated users worldwide — from private surveillance vendors to suspected state-backed groups — hitting targets across very different regions within just a few months. For everyday users, the key takeaway remains simple: keep devices updated to the latest OS version, and consider enabling advanced protections like Lockdown Mode if you believe you may be a high-value target.

This article is based on the original report, “The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors,” published by Google Threat Intelligence Group on March 18, 2026 on the Google Cloud Blog.