Google phát hiện chuỗi lỗ hổng iOS DarkSword nhắm vào ví tiền điện tử

The Google Threat Intelligence Group (GTIG) disclosed the discovery of a full iOS exploit chain named DarkSword, which exploits six vulnerabilities (including multiple zero-days) to achieve complete device control. Since November 2025, this exploit has been used by multiple commercial surveillance vendors and suspected state-sponsored threat actors in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. DarkSword supports iOS versions 18.4 through 18.7. Upon successful compromise, attackers can deploy three types of malware—GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER—all written in JavaScript, capable of stealing communication logs, location history, browser data, and cryptocurrency wallet information, as well as recording audio, taking screenshots, and executing backdoor commands. GTIG reported these vulnerabilities to Apple by the end of 2025, and all have been patched with the release of iOS 26.3. The associated domains have been added to Google Safe Browsing’s blocklist. Users are advised to immediately upgrade to the latest iOS version.