What began as a leaked exploit chain on GitHub has grown into a sprawling, fast-moving web infrastructure built to quietly compromise iPhones. Researchers at Censys have been tracking the campaign, dubbed DarkSword, and report that it now spans 27 hosts and 180 distinct web properties as of late July 2026, a snapshot the researchers stress is already shifting as operators rotate servers.

Who’s at Risk

DarkSword targets iPhones running iOS versions 18.4 through 18.7. The attack begins with lure sites: fake sign-in pages, iOS-themed landing pages, and compromised legitimate web properties that quietly load the exploit chain through hidden content once a victim visits. There’s no app to install and no obvious warning sign, just a visit to the wrong page at the wrong time.

Once triggered, the exploit chain is designed to bypass built-in device protections and deliver a payload called GHOSTBLADE, a set of modules built specifically to collect keychain data, iCloud credentials, saved Wi-Fi passwords, and other sensitive files stored on the device.

Leaked Code, Rapidly Rebuilt Infrastructure

DarkSword itself is a six-vulnerability exploit chain that became public through a leaked GitHub repository. That public leak appears to have accelerated its spread, giving multiple operators access to the same underlying exploit code even as they build out separate delivery infrastructure around it.

Censys tracked this growth by fingerprinting stable elements of the campaign, admin panel layouts and staging-page content that stay recognizable even as the servers hosting them change. That approach revealed operators cycling through infrastructure at a striking pace: one DarkSword admin panel fingerprint turned up across seven hosts spread through Hong Kong, Japan, and the United States, with five of those hosts changing within a single week. The operators have also been observed running operator panels on unusual, non-standard ports, including 3000, 8443, and 8888, likely an attempt to stay off the radar of routine scanning.

In one notable case, a single Hong Kong server was found hosting both a fake Apple ID sign-in page for credential harvesting and active DarkSword staging content side by side, effectively combining two stages of the attack, credential theft and exploit delivery, on one machine. Researchers also noted overlap with older infrastructure: one Singapore-based host that had previously run DarkSword was also linked to Coruna, an earlier iOS exploit framework, suggesting some operators may be reusing infrastructure or tooling across campaigns.

Inside an Attack

When a victim lands on a malicious page, it quietly loads a hidden frame that selects the appropriate exploit code based on the visitor’s detected iOS version. If the exploit succeeds, GHOSTBLADE’s modules go to work collecting credentials, cloud account data, saved network passwords, and files, then exfiltrating that data to attacker-controlled servers. To reduce the odds of forensic discovery, the operators have also been observed actively deleting crash reports and system logs before moving on, an effort to erase the evidence trail an incident responder would normally rely on.

The convincing Apple ID phishing decoys deployed alongside the exploit chain are a particular concern, since they let the campaign steal credentials even from users whose devices might otherwise resist the exploit itself, giving the operators a fallback path to compromise.

What to Do About It

For individual users, the most effective defense remains straightforward: keep iOS updated to the latest available version, since patched devices are not vulnerable to the exploit chain itself, and treat unsolicited sign-in prompts or unfamiliar iOS-themed pages, especially those reached via links in messages or emails, with heavy skepticism.

• Apply iOS updates promptly rather than deferring them, since DarkSword specifically targets a defined range of older point releases
• Avoid entering Apple ID credentials on any page reached through an external link rather than navigating there directly
• Enable two-factor authentication on Apple ID accounts to limit the damage if credentials are harvested
• Security teams protecting high-value individuals, executives, journalists, and others who may be targeted, should consider mobile threat defense tooling capable of detecting exploit-chain behavior, not just known malicious apps

With DarkSword’s underlying exploit code now public and its delivery infrastructure expanding by the week, researchers expect the campaign, or close copies of it, to remain active for some time.