DarkSword iOS Exploit Kit Spreads Across 180 Web Properties and 27 Hosts

DarkSword has expanded from a leaked iOS exploit chain into a broad and fast-changing network of malicious web infrastructure. The campaign targets iPhones running iOS 18.4 through 18.7 and is designed to steal highly sensitive data after a victim visits a lure site. The attack begins with fake sign-in pages, iOS-themed sites, and compromised web properties that load the exploit chain through hidden content. Once triggered, DarkSword can bypass protections, access device data, and deliver GHOSTBLADE modules built to collect keychain, iCloud, Wi-Fi, and other files. Researchers at Censys identified the latest infrastructure growth while tracking stable web-page fingerprints across rapidly changing hosts and domains....

Read the full article at the source.