Dark Sword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover
Summary: A new iOS exploit kit called DarkSword, using six vulnerabilities including three zero-days (CVE-2026-20700, CVE-2025-43529, CVE-2025-14174), has been used by multiple threat actors since at least November 2025 against iPhone users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The chain targets iOS 18.4 through 18.7, begins with a malicious iFrame loaded in Safari, escapes the WebContent sandbox through the GPU process into mediaplaybackd, and exfiltrates data within seconds or minutes before cleaning up.
Key Takeaway: iVerify assesses the combined Coruna and DarkSword campaigns likely affect hundreds of millions of unpatched devices running iOS 13 through 18.6.2, and the kit's presence in the hands of a financially motivated actor alongside a suspected Russian espionage group shows top-tier exploit chains now circulate on a second-hand market.