Affected Systems

Apple iOS devices running versions 18.4 through 18.7. Active campaigns observed targeting Saudi Arabia, Turkey, Malaysia, Ukraine, and Chinese-speaking regions. Multiple threat actors deploying the kit including PARS Defense (Turkish surveillance vendor) and Star Blizzard (Russia-aligned). New variants attempting to target iOS 26.x.

Exploitation Status

Active exploitation confirmed in the wild since November 2025. Multiple threat actors using the kit in ongoing campaigns. Five active C2 servers identified with real victim devices observed polling as recently as September 2026. Exploit kit leaked publicly after March 2026 disclosure, enabling wider adoption. LLM-assisted attempts to update framework for iOS 26.x observed.

Business Impact

P7 DarkSword chains multiple iOS vulnerabilities to escape browser sandbox, escalate to kernel privileges, and inject payload into SpringBoard. The kit exfiltrates iCloud Keychain data, cryptocurrency wallet credentials (including imToken app), Apple Notes, Photos, and enables remote command execution. Implant polls C2 every 15 seconds for tasking. Commercial exploit kit now available on secondary markets to financially motivated actors. Organizations with iOS device fleets face credential theft, financial loss from crypto wallet compromise, and persistent device compromise with full remote access capabilities.

Urgency

🔴 Immediate

Recommended Actions

  • Update all iOS devices to iOS 19.0 or later immediately; DarkSword targets iOS 18.4-18.7 and Coruna targets iOS 13.0-17.2.1
  • Block identified C2 infrastructure: 43.134.165.205, 166.88.95.90, 23.148.212.237, 47.102.192.23, 156.239.230.120
  • Deploy mobile threat defense solutions capable of detecting iOS exploit kit indicators; iVerify, Lookout, and similar platforms have detection signatures
  • Audit iOS devices for signs of compromise: unexpected SpringBoard process behavior, unusual network polling every 15 seconds, localStorage persistence mechanisms
  • Restrict access to cryptocurrency wallet apps on corporate iOS devices and enforce MDM policies preventing installation of untrusted profiles
  • Monitor for phishing campaigns using fake Snapchat sites, Apple ID decoy pages, and invitation lures targeting your organization's geographic regions