DarkSword

Leaked DarkSword iOS Exploit Chain 'P7' Now Steals Crypto Wallet Seeds and Keystores

A third build of the P7 variant of the leaked DarkSword iOS exploit chain has been identified, featuring a new lure site themed around Chinese online casinos and a fresh command server. The chain exploits six vulnerabilities, including three zero-days, to deploy an implant that decrypts the keychain directly on the device and extracts seed phrases from wallets such as imToken, Trust Wallet, and Phantom. Unlike the original GHOSTBLADE, P7 rewrites the C2 agent to focus exclusively on wallet data while retaining the core TaskRop and MIG-filter bypass modules. Passive analysis of public sources also uncovered the long-running 'qqtime' delivery cluster that pairs DarkSword with the older Coruna chain for broader iOS coverage. The operator uses channel codes to support multiple affiliate distributors and employs an AppleKeyStore oracle to decrypt keychain items locally before exfiltration.

Censys Exposes DarkSword iOS Exploit Platform and Coruna Crypto Wallet Stealer

Censys has disclosed the inner workings of DarkSword, a commercial platform that sells remote access to iOS devices, along with its associated malware Coruna that targets cryptocurrency wallet recovery keys. The infrastructure was exposed between September 15 and 17, allowing researchers to analyze the full attack chain starting from a WebKit and JavaScriptCore exploit delivered through the browser. After escaping the Safari sandbox and reaching the kernel, the platform deploys three layers including a flag, controller, and main implant. Coruna then scans the device for BIP39-compliant seed phrases stored in photos and Apple Notes across 19 targeted wallet applications such as MetaMask, Phantom, Trust Wallet, Coinbase, Exodus, imToken, Bitpie, and BitKeep. The exposed server contained 11 victim recovery keys, 179 directories of extracted data, and 75 operator accounts, indicating a structured commercial operation with agent accounts, commissions, and device quotas. Confirmed infections affect devices running iOS 16.1 and 16.3.1, while Apple has extended patches to additional iOS 18 devices. Maintaining updated iOS versions remains the primary defense against this threat.

DarkSword Exploit Kit Expands to 180 Sites Targeting iPhone Users with Zero-Click Chain

The DarkSword exploit kit has scaled its infrastructure to 180 web properties hosted on 27 servers, enabling zero-click compromise of iPhones running vulnerable iOS versions. Attackers deploy fake pages impersonating Apple, AWS, and other popular services to trigger a six-vulnerability exploit chain that achieves remote code execution, sandbox escape, and privilege escalation on iOS 18.4 through 18.7. Once the device is compromised, GHOSTBLADE components extract data from the Keychain, iCloud files, Wi-Fi passwords, and other stored content before exfiltrating it to attacker-controlled panels. The malware deletes crash reports and forensic logs to hinder analysis and does not establish traditional persistence, limiting the window of data theft to a single visit. Infrastructure rotates rapidly, with five of seven administrative panels observed on July 30, 2026, having appeared only a week earlier, indicating frequent domain and host replacement to evade blocking.