DarkSword Server Combines iPhone Exploits With Fake Apple ID Login Page

Gbhackers •Mayura Kathir • August 4, 2026

DarkSword’s leaked iOS exploit chain is now powering a fast‑moving server cluster that marries one‑click Safari exploitation with a convincing fake Apple ID login page, putting millions of iPhone users at risk of seamless device compromise and credential theft. Originally disclosed by Google Threat Intelligence Group, iVerify, and Lookout, the kit was later leaked to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DarkSword Exploit Kit Targets Millions of iPhone Users with Credential Theft The DarkSword exploit kit has emerged, leveraging a leaked iOS exploit chain to create a network of malicious web properties targeting iPhones running iOS 18.4 to 18.7. This campaign employs fake Apple ID login pages to steal sensitive user credentials and data. The exploit chain was initially disclosed by the Google Threat Intelligence Group and has since been linked to a fast-moving server cluster. Millions of iPhone users are at risk as the attack vector allows for seamless device compromise. The infrastructure reportedly spans 180 web properties and 27 hosts, indicating a broad scope of impact. Security experts are urging immediate action to mitigate the risks associated with this exploit kit. 2 sources 67

Extracted Entities

DarkSword Server Combines iPhone Exploits With Fake Apple ID Login Page

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (3)