DarkSword is a new iOS exploit chain that leverages multiple zero-day vulnerabilities to fully compromise iOS devices.

Google Cloud Platform provides a suite of cloud computing services for building, deploying, and managing applications and infrastructure on Google's global network. Developers can learn about cloud-native development, machine learning, and big data analytics to leverage GCP's scalable and reliable cloud infrastructure for their projects.

Google Cloud

Google Threat Intelligence Group (GTIG) has disclosed DarkSword, a full-chain iOS exploit leveraging six zero-day vulnerabilities to fully compromise devices running iOS 18.4–18.7. The exploit chain has been adopted by multiple distinct threat actors since at least November 2025, including commercial surveillance vendor PARS Defense and suspected Russian espionage group UNC6353, targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. DarkSword uses JavaScript-only exploit stages chaining two JavaScriptCore RCE bugs (CVE-2025-31277, CVE-2025-43529), a PAC bypass in dyld (CVE-2026-20700), two sandbox escapes via ANGLE/WebGL and XNU, and a kernel privilege escalation via a VFS race condition. Three distinct malware families were deployed post-compromise: GHOSTBLADE (dataminer), GHOSTKNIFE (full backdoor), and GHOSTSABER (backdoor with modular capabilities). All vulnerabilities have been patched as of iOS 26.3. YARA rules and IOCs are provided for threat hunting.

The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors