DarkSword Exploit Targets iOS 18 Links
💡270M iOS at DarkSword risk—secure Apple devices for AI workflows now.
⚡ 30-Second TL;DR
What Changed
DarkSword exploit hits iOS 18.4 through 18.6.2 via infected links.
Why It Matters
Exposes massive iPhone user base to espionage risks, driving urgent patches. Underscores need for timely updates in mobile ecosystems used for development.
What To Do Next
Update iOS development devices to latest version to patch DarkSword vulnerability.
Key Points
- •DarkSword exploit hits iOS 18.4 through 18.6.2 via infected links.
- •Steals personal info from iPhones visiting malicious websites.
- •Deployed by Russian hackers, risks 270 million outdated devices.
- •Findings from Google Threat Intelligence, Lookout, iVerify.
🧠 Deep Insight
Background and context from public sources — not the original article. 7 sources cited.
🔑 Enhanced Key Takeaways
- •DarkSword leverages six zero-day vulnerabilities and supports iOS versions up to 18.7, broader than the 18.4-18.6.2 range initially reported[1].
- •Post-compromise, it deploys three malware families: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER[1].
- •UNC6353, a suspected Russian espionage group, and UNC6748 have adopted DarkSword, similar to their prior use of the Coruna exploit kit[1].
- •Key vulnerabilities include CVE-2025-43529 (JavaScriptCore DFG JIT garbage collection bug) for iOS 18.6-18.7 and CVE-2026-20700 (dyld PAC bypass)[1].
🛠️ Technical Deep Dive
- •DarkSword chain uses multiple zero-days: for iOS 18.6-18.7, CVE-2025-43529 in JavaScriptCore's DFG JIT layer (garbage collection bug, patched in iOS 18.7.3 and 26.2) develops fakeobj/addrof primitives for arbitrary read/write[1].
- •Chained with CVE-2026-20700, a dyld bug enabling user-mode Pointer Authentication Codes (PAC) bypass for arbitrary code execution (patched in iOS 26.3)[1].
- •Loader modifications include fetching rce_module_18.6.js, with logic flaws failing to serve iOS 18.4 exploit correctly or account for iOS 18.7 (released September 2025)[1].
- •GHOSTKNIFE malware includes snippets for deleting crash logs to evade detection[1].
🔮 Future ImplicationsAI analysis grounded in cited sources
⏳ Timeline
📎 Sources (7)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: The Verge ↗
This is a summary, not the original. Read the source, or get the weekly briefing.
Weekly AI briefing
One email a week. Unsubscribe anytime.