DarkSword zero-click iOS exploit detailed
- Google’s Threat Intelligence Group, with Lookout and iVerify, publicly detailed DarkSword on March 18 — a real iPhone exploit chain already used in attacks. - DarkSword hit iOS 18.4 through 18.7, chained six bugs including three zero-days, and was seen with three payload families named GhostBlade, GhostKnife, and GhostSaber. - The bigger shift is reuse — multiple surveillance vendors and suspected state actors adopted one chain, and leaked code widened the risk.
DarkSword is an iPhone break-in kit. Not a single bug, but a full chain that starts in Safari’s web engine and ends with deep control of the device. That matters because the whole point of iPhone security is layered containment — browser sandbox, app sandbox, kernel protections, memory hardening. DarkSword’s news is that researchers say multiple groups were already using one shared chain to punch through those layers, and by late March part of that code had leaked publicly. ### What is DarkSword, exactly? Basically, it is a packaged exploit framework for iOS. Google’s Threat Intelligence Group said it used six vulnerabilities to compromise devices, while Lookout and iVerify tied it to real-world campaigns and follow-on malware. The chain worked against iPhones on iOS 18.4 through 18.7, with Lookout’s observed range centered on 18.4 through 18.6.2. ### Why is a “full chain” such a big deal? Because a browser bug alone is bad, but usually not enough. A real device takeover needs several steps — code execution, sandbox escape, privilege escalation, and kernel-level access or equivalent control. GTIG said DarkSword primarily used a JavaScriptCore memory-corruption flaw and a dyld PAC bypass, then chained additional bugs to finish the job. That is the difference between “Safari crashed” and “your phone is now someone else’s.” ### Was it really zero-click? That part is fuzzier than the viral posts suggest. The strongest public descriptions point to web delivery through compromised or lure websites, including watering-hole campaigns. TechCrunch described victims being hacked by visiting a site, and GTIG described iframe-loaded exploit code on attacker infrastructure. So the safer framing is near-zero-interaction web compromise, not a pure no-tap Messages-style zero-click in every case. ### Who was using it? More than one actor, which is the scary part. GTIG said it saw DarkSword used since at least November 2025 by commercial surveillance vendors and suspected state-backed operators, with targeting in Saudi Arabia, Turkey, Malaysia, and Ukraine. It also linked one cluster to a PARS Defense customer and another to UNC6353, a suspected Russian espionage group. One chain, multiple customers — that looks a lot like exploit commoditization. ### What happened after compromise? Researchers saw three payload families — GhostBlade, GhostKnife, and GhostSaber. The names sound dramatic, but the behavior is the familiar spyware playbook: steal messages, browser data, location history, and in some cases cryptocurrency-related data, then get out fast. BleepingComputer noted DarkSword also wiped temporary files and exited after collection, which suggests short, hit-and-run surveillance rather than a noisy long-term implant. ### Did Apple patch it? Yes. Apple’s iOS 26.3 and iPadOS 26.3 security release landed on February 11, 2026, and GTIG said all DarkSword vulnerabilities were patched by that release, though most had been fixed earlier. CISA later added three DarkSword-linked CVEs to its known exploited list and gave federal agencies an April 3 deadline to patch. Large numbers of devices stay behind on old versions, and TechCrunch reported that part of DarkSword leaked onto GitHub in March. That lowers the barrier from “elite operator with a private chain” to “anyone who can reuse posted code against unpatched phones.” The exploit itself was advanced. Reuse may not be. ### What should defenders actually do? The boring answer is the real answer — update devices fast, enforce minimum iOS versions, and use Lockdown Mode where risk is high. GTIG explicitly recommended updating and enabling Lockdown Mode if updating is not possible. Lookout’s guidance was similarly blunt: block older iOS builds from enterprise access and treat mobile browsers and webviews as part of the attack surface, not a side issue. The bottom line is that DarkSword is not just another Apple bug story. It is evidence that full iPhone exploitation is becoming a reusable product — shared across operators, repurposed across countries, and dangerous well after patches exist.
