DarkSword iOS exploit kit

An exploit kit for iOS 18

DarkSword attacks iPhones running iOS 18.4 to 18.7.2 through Safari. Google, iVerify and Lookout described it in March 2026, and its code leaked days later. Other operators have served it since.

The kit runs in stages: a browser exploit, two sandbox escapes, a kernel exploit, then a final stage, pe_main.js. It rarely runs alone. The builds we read sit behind a router or gate that reads the iOS version and sends older iPhones to Coruna, the kit for iOS 13 to 17, and iOS 18 to DarkSword. Newer builds add two more chains, SilkPath for the versions in between and GhostWave for iOS 26.

Two loaders

The first loader checks the iPhone OS version in the user agent and stops unless it is iOS 18. It fetches each stage from a folder on its host with cache: 'no-store', keeps the text in window.modules under its file name and runs the entry module, 0cb19f768eb8cd92.js, through eval. When the entry runs, it tells the page that opened it with postMessage({t:'cais_ds',kind:'eval_ok'}).

The second, rce_loader.js, is not obfuscated. It reads the iOS version, picks a worker such as rce_worker_18.6.js for iOS 18.4 to 18.7.2 and logs each step to /log.html on its host. A comment marks 18.7.3 and later as patched.

Routers pair it with Coruna

The lighter router, lp-router.js, ran on 72 sites from 4 October to 5 November 2026 in 17 builds. Their domains copy WhatsApp, Coupang, Hepsiburada, Mizuho Bank and the TokenPocket wallet. The comment at the top names its builder: "Setup, custom development, site maintenance: Telegram @caishenge". Resold builds swap in @qqdata_ops, @rmb132 or an empty handle. One build turns DarkSword on and off through /api/v2/public/darksword-enabled.

On a fake TokenPocket wallet site, the router sends iOS 18 to a /go/<channel code> page it labels "DarkSword PE". It waits up to 120 seconds for the eval_ok message and stores a lock key, __cais_ds_eval_ok_v1, so it does not try twice. The iOS exploit kits page follows that site.

On 154.222.16[.]220, a fake Cloudflare check branded for OKX loads a routing module that sends iOS 18.0 to 18.7 to DarkSword pages named gooll.html, lab_rce.html and lab_187.html. When the first DarkSword stage fails, the loader falls back to Coruna, and both kits report to the same panel.

Builds we matched from 6 November 2026 on 5 sites keep the kit under /nmgo/assets/js/. The landing page we read, miloreel[.]com, poses as a checker for risky USDT addresses. A comment in its HTML marks two off-screen frames as the "EXPLOIT ANCHOR". group.html loads rce_loader.js, allows 5 tries and then stops for ten minutes once a _x_pe_done key is set. The server sets that key as a cookie when it serves pe_worker.js, so a tab that crashes in the kernel stage does not run the chain again. gooll/gooll.html covers older iPhones with a script the page's comment calls a hidden payload chain carried in PNG and 7z files. We have matched landing pages that load gooll.html or group.html in an off-screen frame on 123 sites since 16 October 2026.

A router with four chains

On 6 November 2026 a fake AI computing-power investment site, grabnexusb[.]com, loaded a one-pixel frame from as5nt6omrz453sy[.]icu/next-chain/. Its boot.js picks one of four chains by iOS version:

• iOS 13 to 17.2.1: coruna
• iOS 17.2.2 to 18.3: silkpath, which the code says "fills post-Coruna gap"
• iOS 18.4 to 18.7.2: darksword
• iOS 18.7.3, and iOS 19 to 26: ghostwave

It then asks /api/ds/chain-targets on its server, which can choose a different chain. DarkSword and GhostWave both start from rce_loader.js. The code tells a real iPhone from an emulator by navigator.vendor and by deviceMemory, which Safari does not expose. Each stage is posted to the parent as a ds-stage message and to /api/ds/log.

The server address in its config.js carries the comment "coruna-lab". That is the name a panel gave itself in NetAskari's July 2026 post on Ghostwave, a command panel for the Coruna and DarkSword chains.

A gate framed from a KongTuke site

Gates also turn up on compromised sites. On 8 November 2026 a WordPress site that also carried KongTuke's /asset-cache/fjs tag had an off-screen one-pixel frame to solidgatedomain[.]com/c2/dist/. A visitor the gate turns away sees a page titled "Link unavailable".

Its dist.js calls itself a "DarkSword distribution page". It accepts only iPhones, and from iOS 18.5 on only Safari. The main range is iOS 18.6 to 18.6.2. A second list, which Russian comments dated 28 and 29 October say was opened on the owner's command, adds iOS 18.0, 18.5, 18.7 to 18.7.2, 18.7.8, 26.0 to 26.7, 27.0 and 27.1, and marks iOS 26 and 27 as research. An accepted iPhone gets frame.html, which loads rce_loader.js. Every decision is reported to /log.html. A kill switch dated 27 October sends everyone to the decoy; in this build it was off. On iOS 18.6.1 only, the page also loads a two-pixel image, poc.dng, and reports whether it loaded.

The whole chain hosted on a hacked WordPress site

On 10 November 2026 a compromised WordPress shop carried every DarkSword stage in a folder made to look like core files, /wp-includes/js/analystic/assets/js/. A script added before </body> waits 1.5 seconds after load, then opens group.html from that folder in an off-screen frame with no size.

group.html acts only for iPhones. It posts the site's hostname to /hx on the operator's server with navigator.sendBeacon, the address hidden by XOR with 66, and runs nothing for a visit within 8 seconds of the last one. Below iOS 18 it loads Coruna's dispatcher from the same folder; on iOS 18 it loads the DarkSword loader, which sends the frame to /404.html when it finishes.

The exploit file for iOS 18.1.1 and 18.6 to 18.6.2 is an 85-byte placeholder, so those iPhones get nothing. Every other iOS 18 version gets the working chain from the same folder. The final stage, build 20260914-aks40, reports to the same server as the beacon.

A panel-built gate for any site

Also on 10 November 2026, a compromised site loaded widgets.js from an operator host with a plain script tag. The script calls itself s0_gate.js and tells the buyer to download it from the panel with "Generate & Download". It reports each visitor's system and browser to /hit, then reads /api/config, where the panel sets the iOS range, a decoy page for unwanted visitors, one run per session and a touch-screen check. On 11 November that config targeted iOS 13.0 to 26.0.1, with no decoy.

The gate sends iOS 13 to 17.2.1 to Coruna and iOS 18.4 to 18.7.2 to DarkSword, each in an off-screen one-pixel frame. iOS 18.0 to 18.3 get nothing; a comment marks their offsets as missing. Browsers inside apps are accepted, and a comment in Russian says the gate used to turn them away and lost that traffic.

Reaching iOS 26

Apple went from iOS 18 to iOS 26. Four of the builds above route iOS 26 somewhere, and none of the iOS 26 code we have read is marked ready.

The OKX server's router keeps a route, C10, for iOS 19 and later. On 5 November 2026 its switch, /profiles/c10_deploy.json, read "enabled": false, and /C10/b.html returned 404 on every router host we checked. The C10 code sat on two Cloudflare Pages sites in August and September 2026, with stages named for CVE-2025-43529, CVE-2025-14174 and CVE-2026-20700 and iOS 26 offset profiles carrying placeholder hashes. DarkSword router's iOS 26 route, C10, is switched off has the full read.

The panel-built gate goes further. iOS 26 still reports 18_7 in the user agent, so the gate guesses the real version from features each Safari release added, such as CSS anchor-name for iOS 26. It sends iOS 26.0 and 26.0.1 to the same frame as DarkSword, which loads s2_carrier_26x.js. That file was live on the panel on 11 November: 2.5 MB of new code with offset tables for iOS 26.0.1 on 15 iPhone models and for other iOS 26 releases on one model each. Comments in Chinese and Russian say the offsets were taken from Apple's shared library cache.

The kit's own loader grades it. It calls iOS 18.4 to 18.7.2 DarkSword, weaponized: true. It calls 18.7.3 to 26.5 GhostWave, weaponized: false, with the warning "Do not treat GhostWave as production-ready". iOS 26.0 is graded RESEARCH_HIGH and the rest of 26 RESEARCH, and a comment puts the kernel exploit's ceiling at 26.0.1. Patched iPhones get no chain, except that one visit in ten runs the first stage as a test and reports back.

The kit is sold as Caishen iOS C2 V2

Two Chinese source-code markets sell a kit called Caishen iOS C2 V2. One listing names its chains as Coruna, DarkSword and C10, for iOS 13 to 19. The other, posted on 4 November 2026 for 388 USDT, sells iOS 13 to 18.7 coverage with a landing page and panel.

The 154.222.16[.]220 server uses the name C10 and its banner promises iOS 13 to 18.7. The router names @caishenge as its builder and tags its DarkSword messages cais_ds. A build of lp-router.js we read on 6 November 2026 calls itself the iOS V2 management system in its header comment. A panel we reviewed on 7 November, on darksword.msxfweb[.]net and admin.msxfweb[.]net, is titled in Chinese "iOS exploit backend".

What we see

Month	New sites
September	1
October	6
November so far	35

Checking for a DarkSword loader

Keep the page source, every frame it opens and the scripts each frame loads. Look for:

• an iOS 18 check on navigator.userAgent before any script loads
• JavaScript fetched as text, stored in window.modules and passed to eval
• an entry module named 0cb19f768eb8cd92.js
• cais_ds messages and a __cais_ds_eval_ok_v1 storage key
• an lp-router.js whose comment maps iOS 13-17 to Coruna and iOS 18 to "DarkSword PE"
• routers that send iOS 13 to 17 and iOS 18 to different hidden frames
• /profiles/c10_deploy.json, /profiles/ios_187_gray_gate.json or /gooll/ paths
• off-screen frames to /nmgo/assets/js/group.html, a _x_pe_done key or cookie, and requests to /log.html
• /next-chain/boot.js, ds-stage messages and requests to /api/ds/chain-targets or /api/ds/log
• an off-screen frame to /wp-includes/js/analystic/assets/js/group.html, or a sendBeacon POST of the site's hostname to /hx on another host
• a script tag loading widgets.js or s0_gate.js from another host, a data-dsw-endpoint attribute, or requests to /hit, /api/config or /s1_frame.html on that host
• a hidden one-pixel frame to /c2/dist/, a page titled "Link unavailable", or dist.js setting a data-dist attribute

Remove the router or frame injection and restore the changed files from a trusted deployment. Review CMS, hosting and deployment access and rotate affected credentials.