Darksword can hijack your iphone in seconds and vanish
Google's Threat Intelligence Group, working alongside Lookout and iVerify, has uncovered an iOS exploitation kit that does something most mobile malware doesn't bother doing: it cleans up after itself. DarkSword can seize full control of an iPhone within seconds of a user landing on a compromised website, drain the device of everything worth stealing, and then disappear — no trace, no persistence, no obvious forensic footprint. It has been active since November 2025, and the people behind it are not script kiddies.
How darksword actually works
The initial infection vector identified by GTIG was almost mundane in its execution: a Snapchat-themed website in Saudi Arabia, laced with embedded JavaScript carrying the exploit payload. That banality is part of what makes this dangerous. No zero-day drama, no elaborate phishing chain — just a themed page that looks plausible enough for a few seconds of inattention.
Once triggered, DarkSword deploys one of several modular payloads depending on the target geography and apparent objective. The first and most fully documented is Ghostknife, a JavaScript-based backdoor capable of extracting Safari browser data, login credentials, messages, location history, and audio recordings from the device microphone. It also accepts commands from a C2 server, pulls down files, and takes screenshots. The targeted iOS range — 18.3 through 18.7 — tells you this is not a legacy exploit someone dusted off. This was built for current hardware.
Three payloads, three countries, one framework
The geographic spread is what the GTIG report treats as a signal of scale. Saudi Arabia was the first confirmed deployment. Malaysia surfaced in January 2026 with a different payload, Ghostsaber, focused on device fingerprinting — enumerating accounts, listing files, exfiltrating data, and executing arbitrary JavaScript. It reads less like surveillance and more like reconnaissance, the kind of profiling you do before a more targeted follow-on operation.
Then there's Ukraine. Active payloads deploying Ghostblade were still running as recently as March 2026. Ghostblade shares the same data-collection objectives as its siblings but operates conditionally rather than continuously — a design choice that further reduces its detection surface. Researchers noted a code comment in the analyzed sample that explicitly gates execution to iOS versions 18.4 and above, which GTIG identifies as the minimum version DarkSword's core exploit supports.
The researchers are careful to note that Saudi Arabia, Turkey, Malaysia, and Ukraine represent confirmed deployments, not the full picture. The architecture of this kit — modular, ephemeral, adaptable — is precisely the kind of thing you build when you intend to reuse it across multiple campaigns and operators.
State-sponsored fingerprints, but no clean attribution
GTIG has linked DarkSword activity to both independent threat actors and state-sponsored groups, though the report stops short of pinning it to a single government. That ambiguity is itself informative. The technical sophistication required to build a zero-persistence iOS exploit that reliably executes in seconds is not available to most criminal organizations. The geographic targeting — Ukraine in particular, during an active conflict — is consistent with intelligence-gathering priorities that states, not ransomware gangs, tend to have.
The total number of compromised iPhones remains unknown. Apple has not issued a public statement. What is clear is that DarkSword represents a meaningful shift in mobile threat design: not louder, not more persistent, but faster and quieter. In a threat landscape where detection increasingly depends on behavioral anomalies over time, a payload that executes and evaporates in seconds is, frankly, the harder problem to solve.