DarkSword iOS Exploit Kit Source Code Leaked Online

The Technical Architecture of DarkSword

What makes DarkSword particularly dangerous is its departure from traditional iOS exploitation paradigms. Standard exploit kits historically deployed compiled Mach-O binaries to execute post-compromise tasks, which are increasingly intercepted by modern platform security mechanisms. In contrast, the DarkSword exploit kit performs its entire attack sequence, from initial rendering compromise to local privilege escalation, entirely in-memory using highly optimized JavaScript payloads.

By forcing the iOS WebKit engine to repeatedly run malicious scripts, the exploit constructs stable read and write primitives directly within the browser process. From this initial foothold, the kit progressively compromises lower-level operating system daemons, ultimately escalating privileges to the kernel level. Because no unsigned executable files are written to the disk, legacy mobile security agents often fail to detect the execution of these implants.

The Multi-Stage Technical Attack Chain

Analyzing the leaked source code files, which include core scripts like index.html, rce_loader.js, and pe_main.js, reveals a systematic, four-stage exploit execution pipeline designed to dismantle iOS security controls.

Stage 1: Initial Access and Browser Redirection

The compromise begins when a target visits a compromised legitimate watering-hole website or clicks a link delivered via targeted messaging lures. To guarantee that the exploit runs in the optimal environment, the decoy landing page initiates a protocol redirect. If the user accesses the page using an alternative mobile browser, the page utilizes the x-safari-https handler to force Safari to open the target URL, ensuring WebKit handles the rendering process.

Once loaded inside Safari, the landing page executes profiling scripts contained in index.html and frame.html. These scripts fingerprint the device by checking user-agent strings, canvas rendering behavior, and specific JavaScript engine offsets. If the device matches the targeted iOS version configurations, the main orchestrator, rce_loader.js, is silently retrieved and executed.

Stage 2: WebContent Exploitation and Pointer Authentication Bypass

The exploit kit achieves initial Remote Code Execution (RCE) inside Safari’s tightly restricted WebContent renderer process (com.apple.WebKit.WebContent) by exploiting highly specific memory corruption flaws. Depending on the targeted version of iOS, the framework runs specialized worker threads:

• For systems running iOS versions prior to 18.6, the kit invokes rce_worker.js to exploit a JavaScriptCore optimization type-confusion bug.

• For systems running iOS versions 18.6 through 18.7, the exploit utilizes rce_worker_18.6.js to target a Use-After-Free garbage collection vulnerability within the Data Flow Graph (DFG) Just-In-Time (JIT) compilation layer.

To turn this browser-level crash into stable execution, the framework chains these RCE exploits with a Pointer Authentication Code (PAC) bypass. By exploiting flaws in the dynamic linker (dyld), the JavaScript payload establishes arbitrary memory read and write capabilities, effectively rendering hardware-enforced pointer signing protections inert in user-space.

Stage 3: Multi-Process Sandbox Escape and Kernel Escalation

With RCE established in Safari, the framework must escape the browser sandbox to access sensitive system databases. The exploit chain accomplishes this through consecutive hops across different security boundaries:

• WebContent to GPU Process: The script sbx0_main_18.4.js exploits a memory corruption vulnerability within the ANGLE/WebGL components to escape the WebContent process and execute instructions inside the GPU process.

• GPU to Daemon Process: From the GPU process, the exploit invokes sbx1_main.js, targeting memory-locking vulnerabilities in low-level graphics drivers. This allows the attacker to execute arbitrary code within the context of the highly privileged mediaplaybackd system daemon.

• Kernel Privilege Escalation: Acting from within the daemon, the payload triggers a race condition in the Virtual File System (VFS) layer of the XNU kernel. This final exploit gives the attacker full read and write capabilities over the entire system memory, completely neutralizing the sandbox architecture.

Stage 4: Post-Exploitation Execution and In-Memory Implants

Once kernel read and write access is obtained, the script pe_main.js initiates the payload deployment phase. To bypass advanced memory protections such as Page Protection Layer (PPL), the exploit programmatically injects the legitimate system JavaScriptCore framework into critical system daemons, including configd, wifid, securityd, and SpringBoard. Malicious modules are then parsed and executed inside these trusted processes, completely in-memory, to commence background data harvesting.

Analysis of Modular Spyware Payloads

The leaked framework exposes three discrete family variants, each optimized for specific post-exploitation objectives:

• GHOSTBLADE: A highly aggressive data-mining and stealing implant. It targets local device databases to exfiltrate SMS messages, iMessage history, call logs, Wi-Fi configurations, location logs, browser cookies, and device metadata. Crucially, GHOSTBLADE actively scans device memory and directories for BIP39 mnemonic seed phrases used by cryptocurrency applications, making it highly attractive to financial threat actors.

• GHOSTKNIFE: An intermediate backdoor execution tool that acts as a secure transit and staging module. It is engineered with precise log-cleanup capabilities to evade forensic triage.

• GHOSTSABER: An advanced surveillance implant supporting network reconnaissance, modular package downloading, and arbitrary system command execution.

If the domain already looks exposed, use Dark Web Scanner before requesting a full report. Proactive check allows security teams to verify if corporate domains are exposed to underground markets.

Enterprise Detection and Forensic Tracing

Detecting memory-only exploit kits on mobile devices requires focusing heavily on anomalous console log artifacts, crash patterns, and network exfiltration pathways. Security teams should integrate the following forensic detection checks into their security monitoring protocols:

1. Log Verification via Unified Console

Extracting sysdiagnose logs from suspected iOS devices and searching for debugging messages originating from key system services can reveal active exploitation. Look for explicit log tags written by the exploit orchestrator:

[CHAIN] 
[MAIN] 
[DRIVER-NEWTHREAD] 
[MIG_FILTER_BYPASS] 
[OFFSETS] 
[TASKROP] 
[TASK] 
[PE Post-Exploitation]

Additionally, look for debug messages generated during network dumps or Wi-Fi credential exfiltration, such as [DarkSword-WIFI-DUMP] and [DarkSword-WIFI-DUMP-SECURITYD]. Kernel level errors showing memory structures like target corrupted: followed by absolute hexadecimal kernel addresses are also indicative of exploitation attempts.

2. Forensic File Deletion Indicators

DarkSword incorporates automated cleanup procedures designed to remove temporary files containing stolen database records. The absence of system logs or the sudden removal of these files can indicate a post-exploitation cleanup cycle. Monitor systems for the deletion of files at these paths:

• /tmp/keychain-2.db

• /tmp/System.keybag

• /var/wireless/wifi_passwords.txt

• /private/var/tmp/keychain_dump.txt

3. Device Crash Clustering

Because the exploit kit relies on precise JIT timing and device-specific memory offsets, exploitation attempts frequently fail before succeeding. Analyze device diagnostics for repeated, clustered crashes of WebKit or graphics components, specifically:

• Frequent crash reports for com.apple.WebKit.WebContent.

• Frequent crash reports for com.apple.WebKit.GPU.

• Console errors matching GPUProcessProxy::childConnectionDidBecomeUnresponsive.

Defensive Containment and Mitigations

Securing enterprise mobile environments against highly evasive exploit kits requires a layered defensive posture. Organizations should enforce the following actionable mitigation strategies immediately:

• Enforce Emergency Operating System Updates: Ensure that all corporate and personal mobile devices with access to enterprise resources are updated to the latest supported security releases to patch the underlying WebKit, driver, and kernel vulnerabilities exploited by DarkSword.

• Activate iOS Lockdown Mode: For high-profile individuals, corporate executives, and system administrators, enforce Apple's Lockdown Mode. This security option disables WebKit Just-In-Time compilation, WebGL rendering, and specific system daemons, effectively blocking the entry vectors utilized by this framework.

• Implement Network DNS and Proxy Blocklists: Block outbound traffic to known DarkSword command and control infrastructure at the perimeter. Essential network indicators include domains such as snapshare.chat, sahibndn.io, e5.malaymoil.com, and static.cdncounter.net, along with server IP addresses such as 62.72.21.10 and 72.60.98.48.

• Revoke Compromised Credentials and Session Tokens: If a device exhibits indicators of compromise, immediately invalidate all corporate active directory accounts, cloud SaaS session cookies, and multi-factor authentication (MFA) tokens associated with the user, as the GHOSTBLADE implant targets these assets directly.

Proactive security validation can help companies identify structural weaknesses in their mobile device management policies and network edge configurations before attackers exploit them. Engaging in comprehensive Penetration Testing allows your organization to validate device policies, audit remote access gateways, and ensure that your infrastructure is secure against sophisticated, multi-stage cyber threats.