Apple expands iOS 18 updates to more iPhones to block DarkSword attacks Apple has expanded availability of iOS 18.7.7 so more devices running iOS 18 can receive security updates that protect against the actively exploited DarkSword exploit kit. DarkSword abused six tracked CVEs and was used by actors such as PARS Defense, UNC6748, and UNC6353 to deploy infostealers and backdoors including GhostBlade, GhostKnife, and GhostSaber. #DarkSword #GhostBlade

Apple expands iOS 18.7.7 updates to more iPhones, blocking DarkSword exploit kit that abused six CVEs to deploy infostealers like GhostBlade. Threats linked to PARS Defense, UNC6748, UNC6353. #DarkSword #GhostBlade #USA

DarkSword Exploit Kit Targets iPhones, Steals Crypto Wallet and Personal Data   A newly identified exploit kit named “DarkSword” is being used to target iOS devices and extract a wide range of sensitive user information, including data from cryptocurrency wallet applications. The threat specifically impacts iPhones running iOS versions 18.4 to 18.7 and has been linked to multiple threat actors. Among them is UNC6353, believed to have Russian origins, which leveraged the previously disclosed Coruna exploit chain earlier this month. The exploit kit was uncovered by researchers at mobile security firm Lookout during an investigation into infrastructure tied to Coruna-based attacks. The analysis was further supported by Google’s Threat Intelligence Group (GTIG) and iVerify, providing deeper insights into this emerging threat and the groups behind it. According to iVerify, the exploit chain relies on already known vulnerabilities—covering sandbox escape, privilege escalation, and remote code execution—that have since been patched by Apple in recent iOS updates. DarkSword operates using six vulnerabilities tracked as CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520. According to a report from GTIG, the exploit kit has been active since at least November 2025 and has been deployed by several actors using three distinct malware families: * GHOSTBLADE: A JavaScript-based data stealer that collects extensive information such as cryptocurrency wallet details, system data, browsing history, photos, location, and communications from platforms like iMessage, Telegram, WhatsApp, email, and call logs. * GHOSTKNIFE: A backdoor capable of extracting account credentials, messages, browsing data, location history, and recordings. * GHOSTSABER: Another JavaScript-based backdoor that can enumerate devices and accounts, execute scripts, access files, and steal data. The earliest observed use of this exploit chain is attributed to UNC6748, which targeted users in Saudi Arabia through a website mimicking Snapchat. GTIG also reported that in late November 2025, DarkSword activity was detected in Turkey and linked to PARS Defense, a commercial surveillance vendor. These attacks targeted devices running iOS 18.4 through 18.7. "Unlike the UNC6748 activity, this campaign was carried out with more attention to OPSEC, with obfuscation applied to the exploit loader and some of the exploit stages, and the use of ECDH and AES to encrypt exploits between the server and the victim," GTIG notes. Subsequently, Google researchers observed similar activity in Malaysia, where another PARS Defense client deployed the GHOSTSABER backdoor. UNC6353, suspected to be involved in Russian espionage operations, has been using the Coruna exploit kit since mid-2025 and began deploying DarkSword in December 2025 against targets in Ukraine. These attacks continued into March 2026, primarily through watering hole campaigns involving compromised websites that delivered the GHOSTBLADE malware. Researchers also noted that although "earlier DarkSword use attributed to UNC6748 and PARS Defense also supported iOS 18.7, we did not observe that from UNC6353, despite their later operational timeline." Lookout researchers highlighted that both Coruna and DarkSword show signs of development aided by large language models (LLMs), with DarkSword containing multiple explanatory code comments. “This malware is highly sophisticated and appears to be a professionally designed platform enabling rapid development of modules through access to a high level programming language,” Lookout says. “This extra step shows a significant effort put into the development of this malware with thoughts about maintainability, long-term development and extensibility.” In addition to the one-click exploit kit, iVerify identified a Safari-based exploit chain involving sandbox escape, privilege escalation, and in-memory implants capable of extracting sensitive data. DarkSword attacks typically begin in the Safari browser, where multiple exploits are chained together to gain kernel-level read/write access. A central orchestrator component (pe_main.js) is then used to execute malicious code. While the initial compromise vector remains unclear, attackers were able to inject malicious iframes into targeted websites. The orchestrator then embeds a JavaScript engine into high-privilege iOS services such as App Access, Wi-Fi, Springboard, Keychain, and iCloud, enabling data exfiltration via modules like GHOSTBLADE. The stolen data may include: * Saved passwords * Photos (including hidden and screenshots) * Messaging app databases (WhatsApp, Telegram) * Cryptocurrency wallets (Coinbase, Binance, Ledger, etc.) * SMS messages * Contacts and call history * Location and browsing history * Cookies and Wi-Fi credentials * Apple Health data * Calendar entries and notes * Installed apps and linked accounts Notably, the malware deletes temporary files and exits after exfiltration, suggesting it is not designed for persistent surveillance. Lookout assesses that DarkSword is likely used by a Russian-linked threat actor pursuing both financial gain and espionage objectives aligned with national intelligence interests. Users are strongly advised to update their devices to the latest iOS version. Devices with Lockdown Mode enabled are also protected against both Coruna and DarkSword. In a statement to BleepingComputer, Apple confirmed that patches addressing these vulnerabilities were released last year and extended to older devices as well. The company noted that users running iOS 15 through iOS 26 are already protected, and that devices on iOS 17 and later benefit from the Memory Integrity Enforcement feature, which mitigates such attacks. To enhance security, users should enable passcodes, use strong passwords with two-factor authentication, avoid sideloading apps, and refrain from clicking on suspicious links or attachments.

DarkSword Exploit Kit Targets iPhones, Steals Crypto Wallet and Personal Data #CryptoWalletTheft #DarkSwordexploitkit #GHOSTBLADE

😳

#ghostblade #wangyi #TBHX #tobeheroX #squishyart ##stinkyart

👻🔪💦

#ghostblade #wangyi #TBHX #tobeheroX #squishyart

Rest well baby 👻🔪💤

#ghostblade #wangyi #TBHX #tobeheroX #squishyart

I drew for his birthday last year (ref used!!) 👻🔪

#ghostblade #wangyi #TBHX #tobeheroX #squishyart #stinkyart

The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors | Google Cloud Blog Google Threat Intelligence Group (GTIG) disclosed DarkSword, a JavaScript-based iOS full‑chain exploit that chained six vulnerabilities (including multiple zero‑days) to achieve kernel privileges and deliver post‑exploitation payloads GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. GTIG attributes use of DarkSword to multiple commercial surveillance vendors and suspected state actors (including UNC6353, UNC6748, and PARS Defense), published mitigation guidance, and added delivery domains to Safe Browsing. #DarkSword #GHOSTBLADE

Google Threat Intelligence Group reveals DarkSword, a JavaScript-based iOS exploit chain using six vulnerabilities to deliver GHOST payloads. Linked to state actors targeting Saudi Arabia, Turkey, Malaysia, and Ukraine. #DarkSword #GHOSTBLADE

Tokyo Ghoul AU sketches I never posted 🩸

#TBHX #tobeherox #ghostxblade #ghostblade #herox #squishyart

Adelanto de la segunda temporada 🗣️

#tbhx #tobeherox #herox #ghostblade

ghostblade from tbhx

A drawing I was doing for Ghostblade's bday

#wip #ghostblade #tbhx

#tobeherox #ghostblade #tobeheroxghostblade #tobeheroxfanart #fanart #digitalartwork

The council will decide your fate #ghostblade #tbhx

Even more #ghostblade merch

guys i may like to be hero x 10/10 anime, go watch it
#tobeherox #tbhx #凸变英雄X #tbhxqueen #ghostblade #thejohnnies #tbhxloli

silly gb sticker design concept, i wanna do some more tbhx shitpost sticker designs #TBHX #TOBEHEROX #ghostblade

my copium fueled resolution for gb's arc is that his ass finally retires and he actually starts to play an active role in nuonuo's life. he still doesn't talk a lot or at all but he gets better at communicating his thoughts. #tbhx #TOBEHEROX #ghostblade

More Ghostblade bc why not

#tbhx #ghostblade

Digital illustration of #ghostblade character wearing his suit and a girl (customer #oc) hiding playfully behind it's cape. She peeks out with a mischievous smile and he looks back with a dubious expression.

🌱 A sneaky "Pudding Pals" commission ✨
Loved working on the expressions and the small interaction here — fun and charming to paint 💛

[♥️┊🔃] are appreciated ✨
[☕] Support me on Ko-fi 🤎

🌼[ #commission | #illustration | #イラスト | #VGenComm | #OCxCanon | #YumeSky | #TOBEHEROX | #TBHX | #ghostblade ]🌼

termina AU ghostblade/wang yi as daan for self indulgent purposes #tbhx #ghostblade #gbtbhx #fearandhungertermina

Happy #GhostbladeWeek2025 to you all! It's day 3 which means I can finally show my elevator art. Should be sfw, except for bonus panel 4 (TW: blood) which shows an alternate ending of the scene when GB is too annoyed. #ghostblade #TBHX

my ghostblade shrine is a WIP but here's what we got so far
#ghostblade #tbhx

got even more Ghostblade merch

#tbhx #ghostblade

Made some poster assets!

3/6

#luckycyan #tbhxqueen #ghostblade

when fixation hits me hard but there is so little content from the show so i need to make my own
#tobeherox #heroX #queen #dragonboy #ghostblade #tbhx #art #wip #illustration

Gift for Goatblade (Twitter) who wished to draw a specific meme with the Wang family. #tbhx #Ghostblade #凸变英雄X

LOOOOOK omg this beautiful print I got from @crimsonchains.bsky.social 🩶🤩

#ghostblade #tbhx

lips sealed

#ghostblade #tobeherox #凸便英雄X

Перевод Комикса || Автор vt.tiktok.com/ZSyj6WYpK/.
Полностью: t.me/+OqE-wDt90Cc...

#бытьгероемикс #быть_героем_икс #найс #линьлинь #гоустблэйд #tobeherox #nice #lingling #ghostblade

Signature acquired ♡ It was so lovely to meet Jason, he's super chill 😭💖

#ghostblade #tobeherox

I still can't get over how hot Ghostblade's face is #ghostblade #tbhx