Executive Summary
Recent threat intelligence reveals a widespread expansion of the DarkSword iOS exploit kit following a source code leak on GitHub. At least seven to eight unrelated operators, including a suspected Chinese-speaking group named 'Asia-Pacific Group' (UNC6353), are now actively deploying this commercial-grade exploit chain. The campaign leverages 100+ web properties, primarily masquerading as AWS or Apple ID sign-in pages, to deliver the GHOSTBLADE implant to iOS devices running versions 18.4 through 18.7.
Technical analysis shows that while infrastructure is highly ephemeral—often lasting less than a week—the underlying panel source code and HTML body hashes remain stable. The exploit chain facilitates the deployment of modular information stealers (GHOSTBLADE) designed to exfiltrate keychain data, iCloud credentials, and Wi-Fi passwords. The infrastructure is global but heavily concentrated in Hong Kong and Singapore, often co-hosting DarkSword with other exploit kits like Coruna.
This development signifies a shift where high-end mobile surveillance capabilities, previously restricted to commercial vendors, are now accessible to a broader range of state-sponsored and criminal actors. The rapid churn of domains and IPs highlights the necessity for defenders to pivot toward behavioral and body-hash-based detection rather than static indicator lists.