DarkSword: the iPhone attack built from web pages

A chain written entirely in JavaScript

According to Google Threat Intelligence Group, DarkSword has been used since at least November 2025 against targets in Saudi Arabia, Turkey, Malaysia and Ukraine, by several commercial surveillance vendors and suspected state actors. It affects iOS 18.4 through 18.7[S1]. Lookout cites a narrower range, 18.4 to 18.6.2; the two agree that iOS 18.7.3 and later, and iOS 26.3 and later, fall outside the chain[S2].

Most iPhone chains have needed native code at some stage. This one is written entirely in JavaScript, which makes it easier to host, reuse and adapt. TechCrunch reported in March that a newer build had been posted publicly, and iVerify’s co-founder said it needs no iOS expertise to host[S6]. The Lab does not describe where the code can be found.

How the chain works, in plain words

Five stages, shown in Figure 1[S1]:

1. A hidden frame on a compromised or decoy web page checks the phone and decides whether to proceed.
2. A flaw in the browser engine’s compiler gives the attacker code execution inside the browser, and a second bug defeats pointer authentication, Apple’s guard against hijacked code.
3. A flaw in the graphics layer lets that code escape the browser’s sandbox into a more privileged process.
4. A media service becomes the stepping stone toward the kernel.
5. Two kernel flaws give full control.

Six flaws, three zero-days

A zero-day is a flaw exploited before its vendor can fix it. Apple’s notes for iOS 26.2 and 26.3 say the three listed flaws "may have been exploited in an extremely sophisticated attack" against specific targeted people on versions before iOS 26 [S4][S5]. Google lists the same three among DarkSword’s six[S1]. Apple does not say the two reports describe the same activity; the match is by CVE number.

The fixes arrived in release order, not all at once (Figure 2) [S1][S8].

In order of the stages: CVE-2025-31277 (browser engine, fixed in iOS 18.6); CVE-2025-43529 (browser engine, zero-day, fixed in 18.7.3 and 26.2); CVE-2026-20700 (pointer-authentication bypass, zero-day, fixed in 26.3); CVE-2025-14174 (graphics layer, zero-day, fixed in 18.7.3 and 26.2); and CVE-2025-43510 and CVE-2025-43520 (kernel, fixed in 18.7.2 and 26.1) [S1][S4][S5]. The practical consequence is that a phone could have been partly patched and still be exposed. The chain only works if every link holds, and iOS 26.3 or 18.7.3 and later break it.

A second kit in the same story

DarkSword was disclosed two weeks after Coruna[S3], a different JavaScript kit with 23 exploits in five chains for iPhones on iOS 13 to 17.2.1, which Google documented on 3 March 2026[S10]. Lookout links the two to the same cluster of operators through shared registration traits and a compromised government site that carried a Coruna frame[S2]. For an owner the two reports share a message. Between them they cover iOS 13 through 17.2.1 and iOS 18.4 through 18.7, and the dividing line for DarkSword is iOS 18.7.3 on the older branch and 26.3 on the current one.

Apple said it issued an emergency update on 11 March 2026 for devices that cannot run recent iOS, according to TechCrunch[S6].

Three operators, three implants

Google distinguishes three implants, tracked under operator labels. One cluster it calls UNC6748 is unattributed. Google attributes another implant to a commercial surveillance vendor it names as PARS Defense, based in Turkey. A third cluster, UNC6353, is assessed by Google as a suspected Russia-linked group[S1]. These are Google’s tracking labels and assessments. Lookout’s own assessment of the third cluster is a Russia-backed privateer or criminal proxy[S2].

What it stole, and what it removed

According to Google, the implants take messages from iMessage, WhatsApp and Telegram, keychain data, account details, location, browser data, notes, photos and cryptocurrency wallet data[S1]. They also delete crash reports tied to their own activity, and one stages stolen data in temporary storage. The reports the Lab reviewed describe no mechanism that survives a restart.

That combination, theft in minutes and cleanup behind it, is why the Lab regards this chain as a hard case for any after-the-fact examination.

What a phone keeps

The Lab’s reading of the public descriptions is a list of what is likely to survive, labeled as inference where no source states it.

• Browser records such as history can show a visit to a lure page, but the owner can clear them, and private browsing leaves less.
• Crash reports are what the implants delete, according to Google, so their presence shows little and their unexplained absence is the more interesting fact.
• Temporary files where stolen data was staged are typically cleared by a restart, so they matter only if the device has been extracted promptly.
• Network records such as destinations contacted may be held outside the phone, for example by an organization’s network monitoring.
• The update history, meaning the iOS version, is on the phone and decisive for exposure.

Our assessment

The Lab draws four conclusions from the public record.

First, the web remains a standing, internet-reachable entry point, even though Google counted browsers at under 10 percent of 2025 zero-days as attackers moved into other components[S9]. And multi-flaw chains are overwhelmingly a mobile phenomenon:

Second, the exposed group is defined by software age. TechCrunch estimated, citing Apple data, that about a quarter of iPhone and iPad users were still on iOS 18 or older[S6]. That is a journalist’s estimate, not a measurement of DarkSword exposure.

Third, the version number is the strongest single fact an examiner can establish. A phone on iOS 26.3 or later is outside this chain; a phone on 18.4 through 18.7.2 was inside its range.

Fourth, a missing record can be a clue, but only a weak one. Crash logs also vanish through ordinary retention limits, restores and resets. The Lab’s assessment is that a gap in crash logs near a suspect visit is worth noting and never worth concluding from on its own. It becomes meaningful only beside other evidence, such as a visit to a known lure page or a burst of unexplained network traffic.

What the Lab is watching

• Variants and rebuilds of the public code, and whether any extends to newer iOS releases.
• Apple notes for any new exploited-in-the-wild entry.
• Vendor reports that tie the activity to additional operators.
• Statements on whether Lockdown Mode stops each variant.

What this means for examiners

Updating is the fix. Where updating is impossible, Google recommends Lockdown Mode, and Apple has said Lockdown Mode blocks these attacks [S1][S6]; that is Apple’s statement as reported, not an independent test. An examiner should record the iOS build first, because exposure follows from it.