The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors

Dear Team,

Can you please check and confirm for this security Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword. Since at least November 2025, GTIG has observed multiple commercial surveillance vendors and suspected state-sponsored actors utilizing DarkSword in distinct campaigns. These threat actors have deployed the exploit chain against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.

https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain?hl=en

Details regarding how security issues are handled are available on the Apple security releases page.

The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors
 
 
Q