Leaked DarkSword Exploit Kit Used by Chinese Group to Deploy GHOSTBLADE Spyware

A Chinese threat actor has adopted the leaked source code of the “DarkSword” iOS exploit kit, establishing over 100 malicious web properties to deploy an information-stealing spyware implant known as GHOSTBLADE. The infrastructure relies heavily on fake Amazon Web Services (AWS) login portals and Apple ID credential-harvesting decoys hosted across Hong Kong, Singapore, Japan, Europe, and the United States.

This development highlights the rapid democratization of commercial surveillance tooling once source code leaks into the wild. DarkSword was previously restricted to commercial surveillance vendors and state-sponsored espionage groups, but the public availability of its source code has enabled additional threat actors to target Apple iOS devices running versions 18.4 through 18.7 using established watering-hole and credential phishing techniques.

Exploitation Mechanism and GHOSTBLADE Payload

The attack chain begins when a target visits an attacker-controlled domain—typically a subdomain designed to impersonate the AWS Management Console or a legitimate Apple ID sign-in page. Embedded within these phishing sites is a malicious iframe element that secretly loads JavaScript designed to initiate the DarkSword exploit chain.

DarkSword exploits previously patched memory corruption and WebKit/kernel vulnerabilities in iOS 18.4 through 18.7. Because these flaws are already patched in subsequent iOS releases, the kit relies on driving targets to watering holes or tricking them through credential-harvesting links before they update their devices. Once code execution is achieved in the browser context, the chain escalates privileges to bypass Apple’s sandbox restrictions and executes GHOSTBLADE.

GHOSTBLADE functions as a modular information stealer focused on mobile credential theft and sensitive data exfiltration. Upon successful execution, the implant deploys dedicated modules that perform the following actions:

• Keychain Extraction: Scrapes local storage to dump stored passwords and authentication tokens.
• iCloud Credential Harvesting: Extracts session tokens and cached credentials tied to Apple services.
• Wi-Fi Credential Extraction: Collects saved network SSIDs and WPA/WPA2/WPA3 pre-shared keys.
• File System Exfiltration: Conducts a systematic file sweep, packaging sensitive documents and messages for transmission to command-and-control (C2) servers.

Once data is packaged, it is transmitted back to attacker-controlled administrative dashboards, where operators access the stolen data through web-based control panels.

Infrastructure and Attribution to “Asia-Pacific Group”

Investigations into the underlying infrastructure reveal a global footprint with centralized management nodes. The threat actor relies on three primary administration panels: DarkSword Admin, Decode Dashboard, and C2 Control Panel.

The DarkSword Admin interface was observed across seven hosts in three countries, including a Chinese-language interface running on 38.22.89[.]117:8888 featuring localized fields for authentication. Additional operational nodes include:

• 103.106.190[.]217 (Hong Kong): Co-hosts the C2 Control Panel alongside an Apple ID credential-harvesting decoy.
• 38.181.52[.]95 (Singapore): Ran three distinct exploit-panel front ends. This host historically hosted management interfaces for Coruna—an older iOS exploit kit targeting iOS versions 3.0 through 17.2.1 previously tied to threat actor UNC6353 targeting Ukrainian organizations.
• 93.152.221[.]37 (Frankfurt): An exposed open directory containing offensive tooling, including a web-content fuzzer, an SSH key comment reading jkcing@apt, and references to an unrecorded malware family named “Thorn C2.”

The C2 Control Panel on 103.106.190[.]217 features unique visual signatures: a dark #06060d theme with #ff0050 red accents, an animated particle canvas, and explicit group branding reading “亚太集团” (Asia-Pacific Group). This panel also directly linked to a Telegram contact handle (hxxps://t[.]me/YATA0000), representing the first direct operational contact channel recovered for this cluster.

Despite Chinese-language interface labels and regional branding, code analysis confirms the group is using the leaked DarkSword source code directly rather than re-implementing it. The staging pages share identical cryptographic hashes and carry over Russian-language code comments from the original leaked toolkit, indicating multiple distinct threat clusters are now utilizing the same baseline leak.

Blast Radius and Organizational Impact

For enterprise security operations, the primary threat stems from unauthorized access to corporate cloud resources and sensitive communication channels. Because the attack leverages AWS console impersonation alongside Apple ID decoys, targeted users are likely enterprise administrators, cloud engineers, or high-value personnel with elevated access to cloud infrastructure.

If an unpatched iOS device visits one of these domains:

1. Enterprise AWS credentials may be captured via phishing.
2. Device-level authentication tokens and Wi-Fi credentials are dumped, granting attackers access to internal networks.
3. Multi-factor authentication (MFA) tokens or session cookies stored in the iOS keychain are compromised, bypassing web-based security controls.

The blast radius extends beyond mobile device compromise to potential enterprise-wide cloud environment breach if administrative session tokens are exfiltrated.

Defensive Actions and Mitigation

To defend against DarkSword and GHOSTBLADE deployments, organizations should immediately enforce the following controls:

1. Update Mobile Operating Systems: Ensure all managed and personal iOS devices are updated beyond iOS 18.7, as DarkSword relies on vulnerabilities fixed in post-18.7 builds.
2. Implement Network Blocklists: Block outbound access to known C2 and hosting infrastructure at the DNS and perimeter firewall levels:
   • 103.106.190[.]217
   • 38.181.52[.]95
   • 38.22.89[.]117
   • 93.152.221[.]37
3. Deploy Web Content Filtering: Enforce domain reputation checks on corporate mobile devices to block subdomains attempting to mimic AWS sign-in pages (aws.amazon.com) or Apple ID portals (appleid.apple.com).
4. Enable MDM Compliance Rules: Restrict access to corporate cloud assets (e.g., AWS Console, Okta, Microsoft 365) from non-compliant or outdated mobile operating systems.