DarkSword iOS Toolkit Goes Public on GitHub Lowering Exploit Barriers

DarkSword, an iOS full chain spyware toolkit, has been published publicly on GitHub, potentially lowering the barrier for attackers to exploit vulnerabilities on older iPhone devices. iVerify researchers said the updated version was uploaded to GitHub, making it easier to access and deploy. The disclosure comes as warnings grow about threats targeting older iPhone models and follows earlier discoveries by iVerify, Lookout, and Google Threat Intelligence Group.

The development underscores how security researchers have tracked DarkSword as part of a broader campaign against older iOS versions. The updated tool is described as sharing the same basic infrastructure as the original exploit, with public exposure increasing the likelihood that threat actors could assemble or deploy similar campaigns with limited technical effort. The GitHub repository for the DarkSword project is cited in discussions as the public hosting point for the updated kit, which researchers say targets several iPhone and iPad models running older versions of iOS, notably iOS 18. At the time of publishing this report, the kit remained accessible on the platform.

In a conversation with TechCrunch, Matthias Frielingsdorf, Co-Founder of iVerify, said the updated versions of DarkSword share the same infrastructure as the original exploit. iVerify was one of the security firms that originally identified the hacking campaign, alongside Lookout and Google Threat Intelligence Group (GTIG). This alignment in infrastructure is presented as a key feature of the public release, suggesting that the overall attack chain remains consistent across versions while becoming easier to access through public code sharing.

The security profile of the toolkit centers on its simple composition. According to the code description, it is constructed from basic HTML and JavaScript files and can be hosted on a server in very little time. This way, an attacker can set up a malicious webpage that would compromise sensitive information from a vulnerable device. A visit to the infected webpage would give an attacker a foothold in the victim's device to begin the compromise. Independent security researchers and many of the researchers cited in different public discussions agree that this exploit can function with minimal requirements on the server side, which makes it easier to deploy by anyone who has the technical ability to do so, and who has found the information on how to deploy it.

Beyond access to compromised devices, a security researcher reportedly claimed to have successfully utilised the publicly available version of the exploit to compromise an iPad Mini running iOS 18. This suggests that the attack type has the ability to be carried out by attackers with little or no technical skill, increasing fears regarding how widespread devices running old hardware may be at risk. This assertion further validates the cautionary practices associated with publicly available exploit kits and illustrates why vendors of software products continue to promote the necessity of current support when utilizing such products.

As a company, Apple has confirmed they too are aware of the existence of this exploit on devices operating under out-of-date or older versions of their Mac OS X. In addition, Apple has provided an emergency update specifically designed for all out-of-date Macs to fix vulnerabilities for those who cannot upgrade to the most current iOS version. Lastly, Apple has indicated that those who have the Lockdown mode enabled are hindered from successfully being attacked using this exploit even if their version of iOS is out-of-date. Nevertheless, Apple reiterated that devices should be updated to the latest iOS version as soon as possible to minimize risk.

What follows is a concise overview of what is described by researchers as the DarkSword spyware and its behavior, followed by how the public release intersects with ongoing security responses from Apple and the broader research community. The material below is drawn from the input provided and cited security discussions, without introducing new claims beyond the source data.

What is DarkSword Spyware

The DarkSword spyware is described as an iOS full-chain exploit that leverages multiple zero-day vulnerabilities to fully compromise devices. Now available as a toolkit on code-sharing platforms, it links together several bugs to move from a web page to full control of the phone. The kit is positioned as a capable framework that can enable a sequence of exploitation steps through a browser-based entry point, followed by deeper system access once a device is compromised.

DarkSword is described as designed to extract sensitive data from compromised devices, according to security researchers.

The leaked code's comments detail the workings of an exploit. They also contain precise directions on how to move data out over the Internet; moreover, in some cases, they describe what happens after access is achieved in more detail than just how to steal it from the access point. While experts stress that the public release increases visibility of the toolkit, they also emphasize that the actual likelihood of universal exploitation remains linked to device version, patch status, and user exposure to the attack surface described by the code.

Technical snapshot

The targeted devices (older iPhones/iPads running iOS 18 or older), DarkSword code is available for anyone to use to exploit their victims by using the full chain of exploits created with multiple zero-day vulnerabilities. The vulnerabilities to be exploited have an attack surface of web-hosted malicious HMTL/JavaScript files.

In addition to being vulnerable from just their device itself when using untrusted external access to it, Apple's original intended functionality (to store sensitive information) is also at risk if these exploits are used successfully against unupdated devices. In addition to accessing all contacts, messages and call history associated with the phone number(s) registered to that device, the DarkSword code can also use multiple local device data sources to access stored keys from the Keychain for accessing other online accounts remotely.

Recently an Apple spokesperson reiterated that the best way to mitigate these risks and avoid future similar events with your device would be to update your device to the most current version of iOS as soon as possible. The statement also reiterated that the Lockdown Mode provides protection against this form of attacks against devices running outdated software but does not replace the need for a system upgrade whenever possible. As concerns around DarkSword continue to evolve, researchers remain vigilant regarding the public documentation of exploit codes and how that will impact the future rollout strategies for Apple devices and the behavior of Apple device consumers.