GHOSTBLADE keychain_copier.js credential-dumping module execution

Ethan Andrews@eandrews

•updated Aug 3, 2026•2•0•3

Detects execution or file drop of the GHOSTBLADE keychain-dumping module (keychain_copier.js) or its parent implant (ghostblade.js) on a device following DarkSword iOS exploit-chain compromise.