More than 100 web properties were identified by Censys as part of a coordinated campaign that weaponises the DarkSword iOS exploit kit against Apple devices. That’s a staggering scale for a threat actor that remains unnamed, yet its footprints stretch from Hong Kong to Japan, the United States, and Europe.
Key Takeaways
- Chinese‑linked actor runs over 100 domains hosting fake AWS and Apple ID login pages.
- Leaked DarkSword kit targets iOS 18.4‑18.7, deploying the GHOSTBLADE malware.
- Seven distinct admin panels were mapped, with IPs spanning Hong Kong, Singapore, and the U.S.
- Evidence points to a shared staging‑page hash and Russian‑language comments from the original source.
- Open directory listings expose SSH keys and references to previously undocumented Thorn C2.
DarkSword iOS exploit campaign uncovered by Censys
On July 31, 2026, Censys researcher Aidan Holland published an analysis that traced the operator’s infrastructure to more than 100 domains, most of which masquerade as Amazon Web Services sign‑in pages. It’s clear the actor is banking on users’ trust in familiar cloud‑service branding.
“The hosting concentrates in Hong Kong but reaches into Japan, the United States, and Europe,” Holland said. That quote underscores how the campaign isn’t limited to a single region; it’s a truly global operation.
Infrastructure and Hosting Footprint
The bulk of the malicious hosting sits in Hong Kong, but a Singapore‑based host (38.181.52[.]95) was also observed serving three distinct exploit‑panel front ends. That host is no longer active, yet its legacy remains in the analysis.
Four of the login panels sit behind the IP address 38.22.89[.]117:8888, displaying Chinese‑language field labels for “username,” “password,” and “Log in.” The remaining six IPs are listed below:
- 103.97.128[.]67:8888
- 162.4.136[.]30:8888
- 223.26.63[.]56:8888
- 151.243.126[.]191:8888
- 107.175.49[.]181:3000
- 103.238.129[.]112:3000
Beyond those panels, three additional hosts run Decode Dashboard and C2 Control Panel interfaces. Their IPs are 103.226.155[.]200, 103.226.155[.]201, 202.8.120[.]249, and 103.106.190[.]217. The latter also hosts an Apple ID credential‑harvesting decoy.
“This cluster runs the leaked kit rather than a reimplementation, and the evidence is a shared staging-page hash plus Russian-language code comments carried over from the leaked source,” Holland said.
Exploit Chain: From Watering Hole to GHOSTBLADE
The attack flow begins when a victim lands on a malicious subdomain that mimics an AWS console or Apple ID sign‑in page. A hidden iframe then pulls JavaScript that triggers the DarkSword chain. That’s how the kit exploits now‑patched vulnerabilities in iOS 18.4‑18.7.
Once the exploit succeeds, the malicious payload drops GHOSTBLADE modules. Those modules harvest keychain entries, iCloud credentials, and Wi‑Fi passwords before sweeping the device for files to exfiltrate.
Collected data is packaged and sent to attacker‑controlled endpoints. After exfiltration, the operator logs into one of the admin panels—DarkSword Admin, Decode Dashboard, or C2 Control Panel—to retrieve the stolen information.
Operator Panels and Indicators
The C2 Control Panel stands out with its near‑black background, bright red accents, and an animated particle‑canvas effect. A group name, 亚太集团 (“Asia‑Pacific Group”), appears directly on the page, and a Telegram contact link (hxxps://t[.]me/YATA0000) provides a direct communication channel.
That Telegram handle is the first concrete contact vector recovered for this operator. The other panels merely present a login gate and nothing else, which makes the C2 panel a valuable intelligence source.
In Frankfurt, an open directory listing at 93.152.221[.]37 exposed the operator’s tooling, including an SSH key comment “jkcing@apt,” a web‑content fuzzer, and references to a previously undocumented malware family dubbed Thorn C2.
Implications for iOS Security
DarkSword was initially detailed earlier in 2026 by Google Threat Intelligence Group, iVerify, and Lookout, with attribution to commercial surveillance vendors and suspected state‑sponsored actors. Its public leak has now lowered the barrier for other threat actors to adopt the kit.
That development is concerning because the iOS versions targeted—18.4 through 18.7—are still widely deployed across Apple’s ecosystem. Even though the underlying vulnerabilities have been patched, the existence of a public exploit chain means attackers can still weaponise unpatched devices.
the fact that a Singapore‑based host also ran an admin panel for Coruna, an older iOS exploit kit, suggests a possible overlap of actors or shared infrastructure. Evidence points to threat actor UNC6353 using both DarkSword and Coruna in attacks aimed at Ukrainian targets.
Historical Context
When DarkSword first surfaced in early 2026, industry researchers noted a distinct pattern: the kit combined zero‑day techniques with a modular payload architecture. That design choice made it attractive for surveillance‑focused groups looking to harvest high‑value credentials.
Google Threat Intelligence Group, iVerify, and Lookout each published briefings that linked the kit to commercial surveillance vendors. Those briefings hinted at geopolitical motivations, yet they also underscored the commercial market for exploit‑as‑a‑service.
Later in the year, a leak of the DarkSword source material occurred. The leak included the original staging‑page hash and Russian‑language comments, which the Censys analysis later used to confirm the authenticity of the observed infrastructure. The leak effectively democratized a previously exclusive tool.
Since that breach, multiple unrelated actors have been observed re‑using the same code base. The pattern mirrors earlier exploit‑kit leaks, where a single source becomes the foundation for a broader threat ecosystem. The result is a proliferation of attacks that share a common technical DNA.
That historical trajectory explains why the current campaign reaches across continents. The infrastructure is not the work of a single, isolated team; it is the product of an ecosystem that has matured over months.
Competitive Landscape
DarkSword is not the only iOS exploit kit operating at scale. The Coruna kit, which predates DarkSword, also appears in the Censys findings. Both kits target similar iOS versions, yet they differ in payload composition and command‑and‑control design.
UNC6353, a known threat actor, has been linked to both kits. The dual usage suggests a shared toolbox or perhaps a service model where multiple actors draw from a common repository of exploits. That overlap blurs the line between distinct campaigns and points to a more fluid threat‑actor landscape.
Other unnamed actors have been observed deploying fake AWS and Apple ID portals, a tactic that mirrors the DarkSword approach. The reuse of familiar cloud‑service branding indicates a broader trend: attackers are using trust signals to increase click‑through rates.
Within this competitive arena, the presence of open directory listings provides a low‑effort reconnaissance vector. Operators who expose SSH keys or internal tooling inadvertently aid rivals by revealing infrastructure details that can be repurposed.
the ecosystem shows a convergence of capabilities. As kits become public, the barrier to entry drops, and the number of campaigns that can execute sophisticated iOS attacks grows.
What This Means For You
If you develop iOS applications, you need to assume that phishing‑style login pages can be weaponised to deliver zero‑day exploits. Incorporating runtime integrity checks and enforcing strict certificate pinning can reduce the chance that a malicious iframe loads in your app’s web view.
For security teams, monitoring for the specific IP ranges and domain patterns highlighted by Censys should become a priority. The open directory listings also provide a low‑effort avenue for threat‑intel gathering—so securing your own server directories is essential.
Developers should also consider implementing MFA for any internal tooling that interacts with Apple IDs or AWS consoles. Even if an attacker compromises a credential, the extra factor can stop them at the login gate.
Finally, keep an eye on Telegram channels and other direct‑contact vectors that may be used by threat actors to negotiate ransom or provide updates. Blocking known malicious handles at the network level can prevent accidental exposure.
Three concrete scenarios illustrate the stakes:
- Scenario 1 – Enterprise Mobile Workforce: An employee receives a spoofed Apple ID sign‑in email. The hidden iframe triggers DarkSword, and the device silently installs GHOSTBLADE. Corporate data, including VPN credentials, flows to the attacker before the breach is detected.
- Scenario 2 – App Store Developer: A developer integrates a third‑party SDK that loads remote web content. The SDK inadvertently renders a malicious subdomain, opening the exploit chain. The resulting keychain theft compromises the developer’s own Apple developer account, allowing the attacker to push malicious updates.
- Scenario 3 – Security Operations Center (SOC): Analysts notice traffic to the listed IPs but dismiss it as benign cloud traffic. Later, a breach is discovered, and the logs reveal that the same IPs were used to exfiltrate data. Early detection could have halted the attack.
Each case underscores a different layer of risk. Developers, administrators, and analysts all have a role in shrinking the attack surface.
Key Questions Remaining
- How many additional, undiscovered domains are part of the same infrastructure?
- Will future iOS updates introduce mitigations that render the DarkSword chain ineffective?
- What is the long‑term intent of the operator behind the Asia‑Pacific Group label?
- Can the open directory listings be used to dismantle the underlying command‑and‑control network?
- Will other exploit kits adopt the same modular approach, leading to a wave of similar campaigns?
Answering these questions will require coordinated threat‑intel sharing and continuous monitoring of the identified indicators.
Sources: The Hacker News, original report
