DarkSword’s public leak and rapid reuse
Censys identified an unknown Chinese-threat actor exploiting a publicly leaked copy of the DarkSword exploit kit to mount campaigns against Apple iOS devices. DarkSword was discovered earlier this year by Google Threat Intelligence Group (GTIG), iVerify, and Lookout and is a full-chain exploit kit that has been used in campaigns since at least November 2025. The kit specifically targets iOS versions 18.4 through 18.7 and had already been linked to activity against Saudi Arabia, Turkey, Malaysia, and Ukraine before the leak.
Following the public leak of DarkSword’s source code, Censys observed other actors adopting the tool. The company says the cluster it found is running the leaked kit rather than a reimplementation; evidence includes a shared staging-page hash and Russian-language code comments carried over from the leaked source, Holland noted.
The attack chain and GHOSTBLADE’s payload
Censys describes a consistent attack flow: victims reach one of the operators’ domains — typically an impersonated Amazon Web Services console subdomain or an Apple ID sign-in page — which loads a malicious iframe. That iframe executes JavaScript that triggers the DarkSword chain and ultimately deploys GHOSTBLADE, an information-stealing malware.
On successful exploitation the implant delivers modules that dump keychain items, iCloud data, and Wi‑Fi credentials, then performs file exfiltration. Harvested data is packaged and transmitted to attacker-controlled endpoints. Operators then log into one of the administration panels — DarkSword Admin, Decode Dashboard, or C2 Control Panel — to retrieve the stolen material.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →Infrastructure: panels, IPs, and decoys
Censys found more than 100 web properties tied to the operator, most of them fake AWS sign-in pages hosted alongside the exploit toolkit. The company detailed multiple administration panels and IP addresses associated with those panels and decoys.
- A DarkSword Admin login page was served on 38.22.89[.]117:8888; that panel contained Chinese-language field labels for “username,” “password,” and “Log in.” Six additional hosts matched the same login page: 103.97.128[.]67:8888; 162.4.136[.]30:8888; 223.26.63[.]56:8888; 151.243.126[.]191:8888; 107.175.49[.]181:3000; and 103.238.129[.]112:3000.
- Decode Dashboard instances were identified at 103.226.155[.]200, 103.226.155[.]201, and 202.8.120[.]249.
- The C2 Control Panel was tied to 103.106.190[.]217, which also co-hosted an Apple ID credential-harvesting decoy sign-in page.
- Censys also noted a Singapore-based host, 38.181.52[.]95, which ran three distinct exploit-panel front ends and — while now inactive — had hosted an administration panel for Coruna, an older iOS exploit kit.
- An open directory listing in Frankfurt at 93.152.221[.]37 exposed operator tooling, including an SSH key comment “jkcing@apt,” a web-content fuzzer, and references to a previously undocumented malware family the researchers called Thorn C2.
Coruna, UNC6353, and cross‑kit use
Censys observed overlap between DarkSword infrastructure and Coruna, a prior iOS exploit kit that targets iOS versions 3.0 through 17.2.1. The Singapore host that previously hosted Coruna administration tooling suggests the same or affiliated operators may reuse hosting and management infrastructure. Censys said there is some evidence that a threat actor known as UNC6353 has leveraged both exploit kits in attacks aimed at Ukrainian targets.
The researchers also highlighted a visually distinct C2 Control Panel build: near-black #06060d background, a #ff0050 red accent, an animated particle-canvas effect, a group name rendered on the page as 亚太集团 (“Asia‑Pacific Group”), and a visible Telegram contact link, hxxps://t[.]me/YATA0000 — the first direct contact channel Censys recovered for this operator.
What this means for technologists, enterprises, and end users
- Technologists and security teams: The appearance of leaked exploit source with shared staging hashes and leftover code comments means defenders should hunt for identifiable markers — the specific IPs and panel signatures Censys published — and look for the data-exfiltration patterns tied to GHOSTBLADE modules.
- Affected enterprises and procurement leaders: Fake AWS console subdomains and Apple ID sign-in decoys are being used as watering holes; visibility on external-facing assets and prompt takedown requests for impersonating domains will matter for organizations that use cloud consoles and Apple device fleets.
- End users and the general public: The campaign targets iOS 18.4–18.7 using in-browser JavaScript and decoy pages. Users encountering unexpected credential prompts for AWS or Apple ID sign-ins on unfamiliar pages should treat them as suspicious.
DarkSword’s public leak transformed what had been a narrower, high‑value tool into a wider commodity for opportunistic actors. Censys’s July 31, 2026 analysis ties that diffusion to concrete infrastructure, stolen-data workflows, and at least one usable contact channel for the operator. The forensic artefacts cited — shared staging hashes, Russian-language code comments, exposed SSH key comments, and the specific IPs and panels — give investigators and defenders a threaded map of this campaign that can be tracked and acted upon.
