DarkSword: A Government-Grade iPhone Exploit Kit Just Leaked on GitHub. It Works Out of the Box. 221 Million Devices Are Vulnerable.

The Story

In early March 2026, Google's Threat Intelligence Group (GTIG), iVerify, and Lookout jointly published research on two iOS exploit kits: Coruna (linked to L3Harris/Trenchant, a U.S. government contractor) and DarkSword (a separate tool sold to multiple state-linked operators). Both use WebKit-based exploit chains to fully compromise iPhones and iPads through malicious websites. DarkSword was observed in active use by at least four distinct threat actors across campaigns targeting users in Ukraine, Saudi Arabia, Turkey, and Malaysia since November 2025.

On March 23, someone leaked a newer version of DarkSword on GitHub. The uploaded code is straightforward HTML and JavaScript with developer comments explaining each exploit stage. iVerify co-founder Matthias Frielingsdorf told TechCrunch: "This is bad. They are way too easy to repurpose. I don't think that can be contained anymore. So we need to expect criminals and others to start deploying this." He added: "The exploits will work out of the box. There is no iOS expertise required." A Google spokesperson confirmed they agree with this assessment.

A security hobbyist known as matteyeux demonstrated the point immediately, publicly hacking an iPad mini running iOS 18 using the leaked DarkSword sample and posting the results on X. The time from download to working exploit: minutes.

The threat escalation was immediate. By March 26, Russian threat actor TA446 (a Kremlin-linked espionage group previously tracked by Proofpoint) adopted the leaked DarkSword kit and began deploying it in spear-phishing campaigns. The emails spoofed the Atlantic Council and targeted Russian opposition figures, including Leonid Volkov, a prominent Russian opposition politician. Proofpoint noted that TA446 had never previously targeted iOS devices or iCloud accounts, but "the adoption of the leaked DarkSword iOS exploit kit has now enabled the actor to target iOS devices." This is the proliferation threat playing out in real time: a nation-state exploit becomes commodity malware, and within days, additional adversaries add it to their toolkits.

Apple responded by issuing emergency patches for older iOS versions and taking the unusual step of sending Lock Screen notifications to iPhones and iPads running vulnerable software, urging users to update immediately. Apple spokesperson Sarah O'Rourke confirmed the company was aware of the exploit and stated that Lockdown Mode also blocks DarkSword attacks. Despite these patches, approximately 14.2% of active iOS devices, roughly 221 million iPhones and iPads, remain on vulnerable versions according to iVerify's analysis of market data.

The Adversary Perspective

From a red team lens, DarkSword represents the most significant mobile exploit proliferation event of 2026. Three characteristics make it dangerous at scale.

The attack is entirely browser-based and requires zero interaction. The victim visits a compromised or attacker-controlled website in Safari. The exploit chain fires automatically. No clicks, no prompts, no app installs. The exploit begins with a WebKit/JavaScriptCore vulnerability (CVE-2025-31277 for iOS pre-18.6, or CVE-2025-43529 for iOS 18.6-18.7), achieves code execution, bypasses PAC via a dyld bug (CVE-2026-20700), escapes the WebContent sandbox into the GPU process (CVE-2025-14174), pivots from GPU to mediaplaybackd (CVE-2025-43510), and escalates to kernel (CVE-2025-43520) for full device control. The entire chain runs in seconds.

DarkSword is a smash-and-grab operation, not a persistent implant. Once it achieves kernel access, it rapidly harvests contacts, messages, call history, Safari browsing history, Wi-Fi passwords from the iOS keychain, SIM information, health records, notes, calendar databases, and cryptocurrency wallets. It exfiltrates everything via HTTP to an attacker-controlled server and disengages. There is no persistent implant to detect on the device afterward. The forensic footprint is limited to Safari browser history entries pointing to the exploit delivery domains.

The leaked code is plug-and-play. The GitHub upload includes developer comments, clear variable names, and documentation of each exploit stage. Frielingsdorf at iVerify described it as something anyone could host on a web server "in a couple minutes to hours." Lookout's Justin Albrecht said the leaked version "allows even unskilled threat actors to deploy the advanced iOS espionage kit, turning it into commodity malware." The barrier to entry has collapsed from nation-state capability to script-kiddie accessibility overnight.

Defensive Takeaways