DarkSword iOS Exploit Kit Spreads Across 180 Web Properties and 27 Hosts

Cybersecuritynews •Tushar Subhra Dutta • August 4, 2026

DarkSword has expanded from a leaked iOS exploit chain into a broad and fast-changing network of malicious web infrastructure. The campaign targets iPhones running iOS 18.4 through 18.7 and is designed to steal highly sensitive data after a victim visits a lure site. The attack begins with fake sign-in pages, iOS-themed sites, and compromised web […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DarkSword Exploit Kit Targets Millions of iPhone Users with Credential Theft The DarkSword exploit kit has emerged, leveraging a leaked iOS exploit chain to create a network of malicious web properties targeting iPhones running iOS 18.4 to 18.7. This campaign employs fake Apple ID login pages to steal sensitive user credentials and data. The exploit chain was initially disclosed by the Google Threat Intelligence Group and has since been linked to a fast-moving server cluster. Millions of iPhone users are at risk as the attack vector allows for seamless device compromise. The infrastructure reportedly spans 180 web properties and 27 hosts, indicating a broad scope of impact. Security experts are urging immediate action to mitigate the risks associated with this exploit kit. 2 sources 67

Extracted Entities

DarkSword iOS Exploit Kit Spreads Across 180 Web Properties and 27 Hosts

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)