Chinese Threat Actor Uses Leaked Dark Sword Kit to Deploy GHOSTBLADE on iOS
Summary: Censys reported on July 31, 2026 that an unknown Chinese-speaking threat actor is running more than 100 web properties, mostly fake AWS sign-in pages, to deliver a leaked version of the DarkSword iOS exploit kit that deploys GHOSTBLADE information-stealing malware. DarkSword targets iOS 18.4 through 18.7, uses watering holes to trigger now-patched vulnerabilities, and after exploitation dumps keychain, iCloud, and Wi-Fi credentials before exfiltrating the data to attacker-controlled endpoints.
What you should know: The kit's source code leaked publicly, and Censys found this cluster running the leaked kit itself, complete with Russian-language comments carried over from that source - meaning the tooling is now in the hands of actors beyond the commercial surveillance vendors and suspected state-sponsored groups that used it against Saudi Arabia, Turkey, Malaysia, and Ukraine since at least November 2025.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026