Apple Expands iOS 18 Updates to More iPhones to Block DarkSword Attacks

Apple has taken a decisive step in strengthening mobile security by expanding the availability of its iOS 18.7.7 update to a broader range of iPhones. The move comes in response to active exploitation campaigns leveraging the DarkSword exploit kit, a sophisticated attack framework used to deploy infostealers and persistent backdoors on targeted devices.

What is the DarkSword Exploit Kit?

DarkSword is an advanced exploit kit observed in active threat campaigns targeting iOS devices. It is designed to chain multiple vulnerabilities together, allowing attackers to gain unauthorized access, execute arbitrary code, and maintain persistence on compromised devices.

Security researchers have identified that DarkSword abuses at least six known CVEs, making it a multi-stage exploit framework capable of bypassing traditional mobile security defenses.

• Targets unpatched or partially updated iOS devices
• Uses vulnerability chaining for deeper system access
• Deploys stealthy payloads with persistence capabilities

Threat Actors Behind the Campaign

The DarkSword exploit kit has been linked to multiple advanced threat groups, including:

• PARS Defense
• UNC6748
• UNC6353

These actors are known for conducting targeted cyber espionage and financially motivated attacks. Their use of DarkSword highlights a growing trend of sophisticated mobile-focused attack campaigns.

Malware Payloads: GhostBlade, GhostKnife, and GhostSaber

Once a device is compromised, DarkSword facilitates the deployment of several malicious payloads:

• GhostBlade: An infostealer designed to extract credentials, tokens, and sensitive user data
• GhostKnife: A stealth backdoor enabling remote command execution
• GhostSaber: A persistence-focused implant that ensures long-term access

These tools allow attackers to maintain control over infected devices, monitor user activity, and exfiltrate valuable data without detection.

Apple’s Response: Expanding iOS 18.7.7 Availability

In response to the ongoing threat, Apple has expanded the rollout of iOS 18.7.7 to ensure that a larger number of devices can receive critical security updates. This proactive approach is aimed at closing the vulnerabilities exploited by DarkSword and preventing further attacks.

Key highlights of the update include:

• Patching of six actively exploited vulnerabilities
• Enhanced protections against exploit chaining
• Improved runtime security mechanisms
• Broader device compatibility to increase adoption

Why This Update Matters

Mobile devices are increasingly becoming prime targets for cybercriminals. With over 6.8 billion smartphone users globally, even a small percentage of vulnerable devices can represent a massive attack surface.

• More than 70% of phishing attacks now target mobile devices
• Mobile malware incidents have grown by over 50% year-over-year
• Unpatched vulnerabilities remain one of the leading causes of successful breaches

By extending the availability of iOS 18.7.7, Apple is addressing a critical gap—ensuring that older or less frequently updated devices are not left exposed.

Security Implications for Users and Enterprises

The DarkSword campaign highlights the importance of timely updates and robust mobile security practices. Both individual users and enterprises must remain vigilant.

For Users:

• Install the latest iOS updates immediately
• Avoid suspicious links and untrusted apps
• Enable built-in security features such as Lockdown Mode

For Enterprises:

• Enforce mobile device management (MDM) policies
• Monitor for unusual device behavior
• Implement zero-trust security frameworks

The Bigger Picture: Evolution of Mobile Threats

The emergence of exploit kits like DarkSword signals a shift in the threat landscape. Attackers are investing in more advanced techniques to target mobile platforms, which are often perceived as more secure than traditional endpoints.

This evolution underscores the need for continuous innovation in mobile security, including stronger sandboxing, improved threat detection, and faster patch deployment cycles.

Conclusion

Apple’s expansion of the iOS 18.7.7 update is a critical step in defending against the DarkSword exploit kit and its associated malware. By addressing actively exploited vulnerabilities and increasing update accessibility, Apple is reinforcing its commitment to user security.

However, the responsibility does not rest solely with vendors. Users and organizations must prioritize timely updates and adopt proactive security measures to stay ahead of evolving threats.

Reference Links and Sources

• Apple Security Updates Documentation
• MITRE CVE Database
• Google Threat Intelligence Reports