Research

The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors

GTIG documents DarkSword, a full-chain iOS exploit leveraging multiple zero-days and now adopted by several threat actors since late 2025 — demonstrating how exploit proliferation accelerates once a chain enters the commercial market.

Summary written by editorial AI · Source link below

Filed by Google Threat Intel18 March 20261 min readRead at source ↗

Introduction Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword. Since at least November 2025, GTIG has observed multiple commercial surveillance vendors and suspected state-sponsored actors utilizing DarkSword in distinct campaigns. These threat actors have deployed the exploit chain against t

Editorial Analysis

Why it matters

When a single exploit chain proliferates across multiple threat actors, the window for targeted attacks widens dramatically, making mobile threat defence and rapid patching essential.

What to do

Verify mobile threat defence solutions can detect indicators associated with DarkSword and confirm all managed iOS devices are on the latest supported firmware.

Board brief

A powerful iOS exploit chain is now in the hands of multiple threat groups, increasing mobile attack risk across the enterprise.

Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.

Continue at the source

Read the full report at Google Threat Intel

External link — opens at Google Threat Intel in a new tab.

Continue with

Editorial Analysis

More from the Research Desk