DarkSword Exploit Kit Proliferation Targeting Apple iOS

The DarkSword exploit kit, a high-end commercial iOS exploit chain targeting versions 18.4 through 18.7, has undergone significant proliferation following its leak via the ghh-jb/DarkSword GitHub repository. Technical attribution by Censys has identified a fragmented ecosystem of at least seven to eight distinct threat actor clusters utilizing six different command-and-control (C2) management panels across two distinct codebases. Investigators leveraged a unique "body hash" digital fingerprint to link disparate C2 infrastructures. A primary Chinese-speaking actor has scaled operations using over 100 web properties, primarily deploying high-fidelity fake AWS sign-in pages to facilitate credential harvesting and subsequent iOS device exploitation.

• Incident Overview

  • Transition of DarkSword from a premium, targeted commercial tool to a widely accessible toolkit.
  • Identification of a massive "panel sprawl" where multiple operators utilize shared or similar infrastructure.
  • Source of the initial leak identified as the ghh-jb/DarkSword GitHub repository.

• Attack Mechanics & Exploitation

  • Deployment of a sophisticated six-vulnerability exploit chain targeting recent Apple iOS versions (18.4–18.7).
  • Use of high-fidelity phishing templates, specifically mimicking Amazon Web Services (AWS) sign-in pages.
  • Initial access focus on credential harvesting to facilitate deeper device exploitation.

• Threat Actor Profile & Scale

  • Recognition of at least 7-8 unrelated operator clusters leveraging the leaked DarkSword codebase.
  • Large-scale campaign by a Chinese-speaking actor managing upwards of 100 malicious web properties.
  • Evidence of a highly fragmented but coordinated ecosystem of exploiters.

• Attribution & Infrastructure Analysis

  • Successful technical mapping of C2 infrastructures via a unique "body hash" fingerprint.
  • Discovery of two distinct codebases being managed across six different administrative panels.
  • Use of fingerprinting to link seemingly disparate and unrelated threat actor clusters.

• Defensive Implications

  • Increased threat landscape for Apple iOS users due to the democratization of high-end exploits.
  • Critical need for monitoring and blocking fraudulent AWS-themed phishing domains.
  • Requirement for advanced C2 infrastructure detection using digital fingerprinting techniques.