Chinese Threat Actor Uses Leaked DarkSword Exploit Kit to Deploy GHOSTBLADE on iOS

DarkSword Exploit Kit Utilized in New Campaign

An unidentified Chinese threat actor has been observed conducting a campaign against Apple iOS devices. The actor is leveraging a publicly leaked version of the DarkSword exploit kit, which targets iOS versions 18.4 through 18.7. This kit exploits now-patched vulnerabilities to execute JavaScript and deploy the GHOSTBLADE information-stealing malware.

Campaign Infrastructure and Targets

Attack surface management platform Censys identified the threat actor operating over 100 web properties. Most of these are fake Amazon Web Services (AWS) sign-in pages hosted on a domain that also hosts the exploit toolkit. The hosting infrastructure is concentrated in Hong Kong but extends to Japan, the United States, and Europe, indicating a broad reach for the campaign.

Proliferation Following Source Code Leak

DarkSword, initially discovered by Google Threat Intelligence Group (GTIG), iVerify, and Lookout, is a full-chain exploit kit previously used by commercial surveillance vendors and suspected state-sponsored actors. Its use has expanded significantly after its source code was publicly leaked, allowing other threat actors to adopt and deploy it. Censys findings show multiple login panels for "DarkSword Admin" across various countries, some with Chinese-language fields.

Attack Methodology

The attack typically begins when a victim visits one of the operator's malicious domains, such as an AWS console impersonation or an Apple ID sign-in page. This action loads a malicious iframe element that triggers JavaScript, initiating the DarkSword exploit chain. Upon successful exploitation, the GHOSTBLADE modules are deployed, designed to steal sensitive information including keychain, iCloud, and Wi-Fi credentials.