The full-chain DarkSword iOS exploit kit source code has been leaked on an underground forum. We analyze the technical mechanics of the multi-stage execution framework, its in-memory implants, and critical containment steps for enterprise environments.
Forces redirects using x-safari-https to isolate execution within iOS Safari WebKit renderer.
Exploits CVE-2025-31277 (type confusion) or CVE-2025-43529 (JIT use-after-free).
Chains CVE-2026-20700 in dynamic linker (dyld) to establish read/write primitives.
Uses CVE-2025-14174 (WebGL memory corruption in ANGLE) to escape to GPU process.
Exploits CVE-2025-43510 driver locking issue to compromise mediaplaybackd.
Triggers CVE-2025-43520 (VFS race condition) to obtain complete system memory read/write.
Bypasses PPL to load malicious JS payload modules directly into legitimate daemons.
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
A sophisticated cryptocurrency drainer targeting Trust Wallet users on Tron, Ethereum, and Solana is being commercialized on Exploit.in. Utilizing deep link abuse and ERC-20 approval exploitation, this tool allows threat actors to bypass standard warnings and drain corporate virtual asset wallets.
The alleged sale of the Stealc_v2 information-stealing malware source code on the exploit.in forum introduces major corporate security challenges. Featuring a PHP administration panel, customizable builders, and Telegram bot integrations, this leak enables rapid deployment of stealthy credential-harvesting campaigns.
June 25, 2026
A threat actor is selling the source code of the Predator 1.6 remote access trojan and file binder on the cybercrime forum Spear. This development lowers the technical barrier for deploying persistent backdoors, posing immediate security risks that demand behavioral EDR rules and path restrictions.
The source code for DarkSword, an alleged iOS exploit kit and spyware framework, has been leaked on the Exploit.in underground cybercrime forum. This leak exposes a highly sophisticated, multi-stage cyber espionage framework designed to achieve complete compromise of Apple mobile devices. Rather than relying on compiled binaries, the entire exploit chain is orchestrated using JavaScript, allowing the framework to execute memory-only payloads and bypass severe operating system mitigations without triggering standard binary signature detection. The public release of this framework severely lowers the barrier of entry for motivated cybercriminals, presenting immediate, elevated risks to corporate infrastructure and executive communications.
Because threat actors routinely target high-profile personnel via specialized mobile spyware, understanding and detecting these stealthy execution pipelines is paramount for enterprise security teams. Organizations must monitor underground message boards and code repositories to proactively intercept evolving variants of this toolkit. Deploying comprehensive enterprise safeguards, such as proactive Dark Web Monitoring, can help security administrators identify if their internal data, software, or credentials have already been traded or targeted on these dark web marketplaces.
What makes DarkSword particularly dangerous is its departure from traditional iOS exploitation paradigms. Standard exploit kits historically deployed compiled Mach-O binaries to execute post-compromise tasks, which are increasingly intercepted by modern platform security mechanisms. In contrast, the DarkSword exploit kit performs its entire attack sequence, from initial rendering compromise to local privilege escalation, entirely in-memory using highly optimized JavaScript payloads.
By forcing the iOS WebKit engine to repeatedly run malicious scripts, the exploit constructs stable read and write primitives directly within the browser process. From this initial foothold, the kit progressively compromises lower-level operating system daemons, ultimately escalating privileges to the kernel level. Because no unsigned executable files are written to the disk, legacy mobile security agents often fail to detect the execution of these implants.
Analyzing the leaked source code files, which include core scripts like index.html, rce_loader.js, and pe_main.js, reveals a systematic, four-stage exploit execution pipeline designed to dismantle iOS security controls.
The compromise begins when a target visits a compromised legitimate watering-hole website or clicks a link delivered via targeted messaging lures. To guarantee that the exploit runs in the optimal environment, the decoy landing page initiates a protocol redirect. If the user accesses the page using an alternative mobile browser, the page utilizes the x-safari-https handler to force Safari to open the target URL, ensuring WebKit handles the rendering process.
Once loaded inside Safari, the landing page executes profiling scripts contained in index.html and frame.html. These scripts fingerprint the device by checking user-agent strings, canvas rendering behavior, and specific JavaScript engine offsets. If the device matches the targeted iOS version configurations, the main orchestrator, rce_loader.js, is silently retrieved and executed.
The exploit kit achieves initial Remote Code Execution (RCE) inside Safari’s tightly restricted WebContent renderer process (com.apple.WebKit.WebContent) by exploiting highly specific memory corruption flaws. Depending on the targeted version of iOS, the framework runs specialized worker threads:
For systems running iOS versions prior to 18.6, the kit invokes rce_worker.js to exploit a JavaScriptCore optimization type-confusion bug.
For systems running iOS versions 18.6 through 18.7, the exploit utilizes rce_worker_18.6.js to target a Use-After-Free garbage collection vulnerability within the Data Flow Graph (DFG) Just-In-Time (JIT) compilation layer.
To turn this browser-level crash into stable execution, the framework chains these RCE exploits with a Pointer Authentication Code (PAC) bypass. By exploiting flaws in the dynamic linker (dyld), the JavaScript payload establishes arbitrary memory read and write capabilities, effectively rendering hardware-enforced pointer signing protections inert in user-space.
With RCE established in Safari, the framework must escape the browser sandbox to access sensitive system databases. The exploit chain accomplishes this through consecutive hops across different security boundaries:
WebContent to GPU Process: The script sbx0_main_18.4.js exploits a memory corruption vulnerability within the ANGLE/WebGL components to escape the WebContent process and execute instructions inside the GPU process.
GPU to Daemon Process: From the GPU process, the exploit invokes sbx1_main.js, targeting memory-locking vulnerabilities in low-level graphics drivers. This allows the attacker to execute arbitrary code within the context of the highly privileged mediaplaybackd system daemon.
Kernel Privilege Escalation: Acting from within the daemon, the payload triggers a race condition in the Virtual File System (VFS) layer of the XNU kernel. This final exploit gives the attacker full read and write capabilities over the entire system memory, completely neutralizing the sandbox architecture.
Once kernel read and write access is obtained, the script pe_main.js initiates the payload deployment phase. To bypass advanced memory protections such as Page Protection Layer (PPL), the exploit programmatically injects the legitimate system JavaScriptCore framework into critical system daemons, including configd, wifid, securityd, and SpringBoard. Malicious modules are then parsed and executed inside these trusted processes, completely in-memory, to commence background data harvesting.
The leaked framework exposes three discrete family variants, each optimized for specific post-exploitation objectives:
GHOSTBLADE: A highly aggressive data-mining and stealing implant. It targets local device databases to exfiltrate SMS messages, iMessage history, call logs, Wi-Fi configurations, location logs, browser cookies, and device metadata. Crucially, GHOSTBLADE actively scans device memory and directories for BIP39 mnemonic seed phrases used by cryptocurrency applications, making it highly attractive to financial threat actors.
GHOSTKNIFE: An intermediate backdoor execution tool that acts as a secure transit and staging module. It is engineered with precise log-cleanup capabilities to evade forensic triage.
GHOSTSABER: An advanced surveillance implant supporting network reconnaissance, modular package downloading, and arbitrary system command execution.
If the domain already looks exposed, use Dark Web Scanner before requesting a full report. Proactive check allows security teams to verify if corporate domains are exposed to underground markets.
Detecting memory-only exploit kits on mobile devices requires focusing heavily on anomalous console log artifacts, crash patterns, and network exfiltration pathways. Security teams should integrate the following forensic detection checks into their security monitoring protocols:
Extracting sysdiagnose logs from suspected iOS devices and searching for debugging messages originating from key system services can reveal active exploitation. Look for explicit log tags written by the exploit orchestrator:
[CHAIN]
[MAIN]
[DRIVER-NEWTHREAD]
[MIG_FILTER_BYPASS]
[OFFSETS]
[TASKROP]
[TASK]
[PE Post-Exploitation]Additionally, look for debug messages generated during network dumps or Wi-Fi credential exfiltration, such as [DarkSword-WIFI-DUMP] and [DarkSword-WIFI-DUMP-SECURITYD]. Kernel level errors showing memory structures like target corrupted: followed by absolute hexadecimal kernel addresses are also indicative of exploitation attempts.
DarkSword incorporates automated cleanup procedures designed to remove temporary files containing stolen database records. The absence of system logs or the sudden removal of these files can indicate a post-exploitation cleanup cycle. Monitor systems for the deletion of files at these paths:
/tmp/keychain-2.db
/tmp/System.keybag
/var/wireless/wifi_passwords.txt
/private/var/tmp/keychain_dump.txt
Because the exploit kit relies on precise JIT timing and device-specific memory offsets, exploitation attempts frequently fail before succeeding. Analyze device diagnostics for repeated, clustered crashes of WebKit or graphics components, specifically:
Frequent crash reports for com.apple.WebKit.WebContent.
Frequent crash reports for com.apple.WebKit.GPU.
Console errors matching GPUProcessProxy::childConnectionDidBecomeUnresponsive.
Securing enterprise mobile environments against highly evasive exploit kits requires a layered defensive posture. Organizations should enforce the following actionable mitigation strategies immediately:
Enforce Emergency Operating System Updates: Ensure that all corporate and personal mobile devices with access to enterprise resources are updated to the latest supported security releases to patch the underlying WebKit, driver, and kernel vulnerabilities exploited by DarkSword.
Activate iOS Lockdown Mode: For high-profile individuals, corporate executives, and system administrators, enforce Apple's Lockdown Mode. This security option disables WebKit Just-In-Time compilation, WebGL rendering, and specific system daemons, effectively blocking the entry vectors utilized by this framework.
Implement Network DNS and Proxy Blocklists: Block outbound traffic to known DarkSword command and control infrastructure at the perimeter. Essential network indicators include domains such as snapshare.chat, sahibndn.io, e5.malaymoil.com, and static.cdncounter.net, along with server IP addresses such as 62.72.21.10 and 72.60.98.48.
Revoke Compromised Credentials and Session Tokens: If a device exhibits indicators of compromise, immediately invalidate all corporate active directory accounts, cloud SaaS session cookies, and multi-factor authentication (MFA) tokens associated with the user, as the GHOSTBLADE implant targets these assets directly.
Proactive security validation can help companies identify structural weaknesses in their mobile device management policies and network edge configurations before attackers exploit them. Engaging in comprehensive Penetration Testing allows your organization to validate device policies, audit remote access gateways, and ensure that your infrastructure is secure against sophisticated, multi-stage cyber threats.