DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover

A new iOS exploit kit called DarkSword uses 6 vulnerabilities including 3 zero-days to achieve full device takeover and rapid data exfiltration.

• •The kit targets iPhones running iOS 18.4–18.7, exploiting JavaScriptCore JIT, PAC bypass in dyld, ANGLE, and kernel flaws (CVE-2025-31277, CVE-2026-20700, CVE-2025-43529, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520)
• •Written entirely in JavaScript, DarkSword escapes Safari's WebContent sandbox, pivots into the GPU process, then into mediaplaybackd to gain privileged access
• •The infostealer payload (GHOSTBLADE) harvests emails, contacts, SMS, crypto wallet data, passwords, photos, and location history before exfiltrating via HTTP(S)
• •Multiple threat actors have used DarkSword: UNC6353 (suspected Russian espionage) targeting Ukraine, UNC6748 targeting Saudi Arabia, and Turkish vendor PARS Defense