Darksword Spyware Hits Millions of iPhones

🔑 Enhanced Key Takeaways

• •DarkSword targets iOS versions 18.4 through 18.7, using a hit-and-run technique to exfiltrate data like credentials, cryptocurrency wallets, and iCloud files before self-deleting.[1][2]
• •Attributed to UNC6353, a suspected well-funded Russian threat actor with financial and espionage motives, who previously used the Coruna exploit kit.[2][4][5]
• •Discovered by Lookout Threat Labs in collaboration with Google Threat Intelligence Group and iVerify while investigating Coruna infrastructure.[1][3][4]

🛠️ Technical Deep Dive

• •Leverages six vulnerabilities including type confusion, use-after-free, out-of-bounds write, copy-on-write kernel bugs, and kernel privilege escalation, all previously fixed by Apple.[2][3]
• •Starts with Safari/WebKit exploits (e.g., CVE-2025-43529 in JavaScriptCore DFG JIT), pivots via WebGPU/ANGLE out-of-bounds write for sandbox escape, then targets XNU kernel via AppleM2ScalerCSCDriver.[3][5]
• •Bypasses PAC and TPRO mitigations by abusing dyld structures and thread state manipulation; deploys payloads like GHOSTBLADE, GHOSTKNIFE, GHOSTSABER with full kernel privileges.[3][5]
• •Server-side components show LLM-generated code with detailed comments, enabling modular extensibility in a high-level language despite poor OPSEC like un-obfuscated JavaScript.[2][4]

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline