DarkSword exploit code now public on GitHub affects Apple’s older iOS

A newer version of the DarkSword exploit has been published on GitHub, making the code accessible to anyone with basic hosting knowledge. Pesquisadores security officials warn that HTML and JavaScript files allow rapid attacks against iPhones and iPads running older versions of iOS and iPadOS. Public disclosure increases the risk of data theft or outright compromise of devices that have not yet received the latest Apple fixes. Especialistas indicate that the exploits work out of the box without the need for advanced Apple systems expertise.

Grupo of Inteligência of Ameaças of Google, along with iVerify and Lookout, initially detailed the DarkSword exploit chain last week. Essa tool combines multiple vulnerabilities to compromise devices running iOS between versions 18.4 and 18.7. The attacks exploit flaws in WebKit and other components, allowing the execution of code with elevated privileges and the extraction of sensitive information.

• The leaked files share similar infrastructure to that previously analyzed by researchers.
• Any user can copy the content and host it on a server within minutes.
• The exploits mainly target devices that have not been updated for the emergency fixes.
• Apple has already released patches that mitigate the flaws exploited by the DarkSword chain.
• The final payloads include malware families such as GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER.

Technical details of the leak

The leak includes simple files that make it easy for malicious actors to reuse. Matthias Frielingsdorf, co-founder of iVerify, classified the situation as serious because the code is easy to adapt and implement. Ele noted that the exploits do not require in-depth knowledge of iOS to operate, which expands the potential for use by common criminals. The simplicity of HTML and JavaScript files allows actors with limited resources to replicate attacks on short notice.

The publication on GitHub occurred after the initial disclosure of the Coruna and DarkSword vulnerabilities. Ambas chains depend on fixes that Apple has made available in updates like iOS 16.7.15, iOS 15.8.7, and iPadOS equivalents. Dispositivos incompatible with newer versions of the system still receive these security patches.

Impact on users of older devices

Many iPhones and iPads in global use still operate on outdated versions due to hardware limitations. The leak increases the likelihood of mass campaigns that exploit compromised websites to deliver the exploit without user interaction beyond accessing the page. The final payloads can steal credentials, forensic data and application information, including cryptocurrency wallets. Apple issued a statement reinforcing the need for an immediate update.

The manufacturer confirmed that it was aware of the leak and reiterated that emergency patches were released on March 11 to cover the flaws. Especialistas recommend that iPhone owners check their update history and turn on automatic software checking. Installing recent patches drastically reduces the attack surface even on devices that don’t support the latest major versions of iOS.

Recommendations from Apple and experts

The company highlighted that Modo of Bloqueio provides an additional layer of protection against advanced intrusion attempts. Usuários of older models should immediately check the software settings to install available security versions. Pesquisadores note that the simplicity of the files facilitates adaptation by third parties. The security community is watching the potential increase in incidents in the coming weeks.

The DarkSword chain utilizes six different vulnerabilities to achieve kernel-level code execution. Três of these were exploited as zero-days before the Apple corrections. The kit allows the deployment of payloads focused on rapid data extraction followed by cleaning the device. Campanhas Previous attacks associated with this actor involved attacks via watering hole websites.

Preventive measures for protection

Users should prioritize updating to the latest available versions of iOS or iPadOS. Ativar or Modo of Bloqueio is advisable in high-risk scenarios. Evitar accessing suspicious links and keeping your browser updated complement basic defenses against WebKit-based exploits. Especialistas emphasize that regular maintenance of the operating system remains the main barrier against threats of this type.

Apple maintains patch distribution channels even for older hardware, demonstrating commitment to users’ long-term security. The current episode serves as a practical reminder of this reality in the Apple ecosystem. DarkSword supports iOS versions 18.4 through 18.7 and has been observed in campaigns by multiple actors since November 2025.

Risks magnified by code simplicity

The published files contain elements that explain how the flaws work and the implementation of the exploits. Essa feature makes adaptation by third parties even easier. Pesquisadores warn that the risk of proliferation for common criminal campaigns grew significantly after the leak. The infrastructure shared between the analyzed and leaked versions indicates continuity in development by the original creators.

The modular structure allows different actors to adapt the kit for specific objectives, from espionage to financial theft. The leak democratizes access to a tool previously restricted to more sophisticated groups. Manter The updated operating system protects against known exploits and reduces the window of opportunity for new attacks.