Google says DarkSword iPhone exploit chain has been used by multiple actors

Google Threat Intelligence Group said it has identified a new iPhone exploit chain it calls DarkSword, and said it had seen multiple commercial surveillance vendors and suspected state-sponsored actors use it in separate campaigns since at least November 2025. The group said the attacks targeted devices in Saudi Arabia, Turkey, Malaysia and Ukraine.

Google said DarkSword works against iOS versions 18.4 through 18.7 and uses six vulnerabilities to deliver final-stage payloads. It said three malware families have followed successful compromises: GHOSTBLADE, GHOSTKNIFE and GHOSTSABER.

The company said it has seen several different users of the exploit chain dating back to November 2025 and thinks others may also be using it. It also said UNC6353, a suspected Russian espionage group previously seen using the Coruna exploit kit, has incorporated DarkSword into watering-hole campaigns.

Google compared the pattern to Coruna, another iOS exploit kit it tracked during 2025 across customers of surveillance vendors, suspected state-linked activity and later broader use by another threat actor. In that earlier case, the company said the kit included full exploit chains and was later used with a stager that injected into iOS processes.

Sources

• The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors

• Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit