DarkSword has expanded its operations from a leaked iOS exploit chain into a comprehensive network of malicious web infrastructure. The campaign targets iPhones running iOS 18.4 through 18.7, aiming to steal highly sensitive data after users visit lure sites. As of July 30, 2026, Censys observed 27 hosts and 180 web properties bearing the DarkSword label, though researchers emphasized these represent a dynamic snapshot rather than an exhaustive list.
Three Hong Kong hosts adopted a five-port pattern, while one Singapore host previously utilized DarkSword alongside Coruna, an older iOS exploit framework discussed in earlier Coruna exploit analysis.
Panel titles: DarkSword Admin Operator panel title Decode Dashboard Operator panel title C2 Control Panel Operator panel title Coruna Co-resident exploit-kit panel title DarkSword DarkSword management panel title iOS Exploit Dashboard Operator console title File names: index.html Staging-page file ghostblade.js GHOSTBLADE payload module keychaincopier.js Keychain collection module wifipasswordsecurityd.js Wi-Fi credential-related module iclouddumper.js iCloud data collection module filedownloader.js File collection module loader.js Exploit loader wifipassworddump.js Wi-Fi password collection module rcemodule.js Remote code execution module rcemodule18.6.js iOS 18.6 remote code execution module rceworker.js Remote code execution worker rceworker18.6.js iOS 18.6 remote code execution worker rceworker18.4.js iOS 18.4 remote code execution worker rceloader.js Version-dispatch exploit loader Frame.html Hidden iframe loader sbx1main.js Sandbox escape module pemain.js Privilege escalation module RemoteLog.log Log file deleted during anti-forensics cleanup.
