New threat to millions of Apple users, ”DarkSword” flaw discovered

According to GTIG monitoring, this threat has been adopted by multiple actors, including commercial surveillance providers and state groups, to target targets in Saudi Arabia, Turkey, Malaysia and Ukraine. The proliferation of this tool among disparate actors follows patterns already observed previously, highlighting an increasingly active market in the exchange of advanced digital espionage tools.

From a technical point of view, DarkSword is compatible with iOS versions between 18.4 and 18.7. The chain exploits six different vulnerabilities to deliver final-stage payloads, identified in the GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER malware families. Groups that have integrated this exploit into their operations include UNC6353, a threat cluster previously associated with espionage campaigns, which recently adopted DarkSword for watering hole attacks. Vulnerabilities used include JavaScriptCore memory management flaws (CVE-2025-31277 and CVE-2025-43529) and Pointer Authentication Codes (PAC) bypass in dyld (CVE-2026-20700).

A relevant case study concerns the activity of group UNC6748, which used a Snapchat-themed counterfeit site to target users in Saudi Arabia in November 2025. The infection process involved the use of obfuscated JavaScript and dynamic IFrames to prevent reinfection of the same subjects and hinder researchers’ analysis. “The loader was modified to fetch an RCE payload,” simulating the behavior of legitimate applications to mask data exfiltration. Apple took steps to correct the flaws with the release of iOS 26.3, but the persistence of these attacks highlights the need for timely updates or, alternatively, the activation of “Lockdown Mode” for high-risk profiles.

The collective research confirms that the analysis of data and digital infrastructures is crucial not only for prevention, but as “near-real-time decision support”. Telematics and threat intelligence remain essential tools for understanding attack dynamics and protecting the integrity of mobile operating systems on a global scale. Through joint work with iVerify and Lookout, it was possible to map the domains involved and include them in the Safe Browsing protocols, ensuring a coordinated response to one of the most sophisticated threats of recent years.