DarkSword

A Chinese threat actor is using a leaked DarkSword exploit kit to deploy GHOSTBLADE on Apple iOS devices. Censys identified over 100 web properties operated by the actor, primarily fake Amazon Web Services sign-in pages hosting the exploit toolkit.

Apple warns users about FaceTime-based scams where attackers impersonate trusted organizations like Apple Support or banks to steal sensitive information, such as banking credentials and Apple ID details. Scammers use social engineering tactics, including urgent alerts and fake technical issues, to pressure victims into sharing data or installing malicious software. Apple advises avoiding unsolicited calls, updating iOS, and using security tools to mitigate risks.

Apple has addressed the DarkSword mobile OS-cracking tool by integrating a patch into iOS 18, offering protection even for users on older iOS 26 systems. This move marks a significant security update despite the unconventional approach of targeting a previously unpatched vulnerability.