The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors

Google Threat Intelligence Group (GTIG) details DarkSword, a full-chain iOS exploit leveraging six zero-day vulnerabilities, adopted by multiple threat actors since November 2025.

• •DarkSword targets iOS 18.4–18.7 using six vulnerabilities including CVE-2025-31277 (JavaScriptCore memory corruption) and CVE-2026-20700 (PAC bypass in dyld).
• •Three distinct malware families were identified post-compromise: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER.
• •Threat actor UNC6748 deployed a Snapchat-themed watering hole site (snapshare[.]chat) targeting Saudi Arabian users, delivering the GHOSTKNIFE backdoor.
• •GHOSTKNIFE is a JavaScript backdoor supporting exfiltration of accounts, messages, location, browser data, audio recording, and screenshots, communicating via ECDH/AES-encrypted custom binary protocol over HTTP.