Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS

A Chinese threat actor is leveraging a leaked version of the DarkSword exploit kit to compromise iOS devices through vulnerabilities that Apple has since patched, meaning victims running outdated software remain exposed. The campaign uses over 100 convincing fake AWS sign-in pages to lure targets, demonstrating how social engineering and technical exploitation are combined for maximum impact. The deployed GHOSTBLADE malware silently exfiltrates credentials and sensitive data, making delayed patching directly responsible for potential data loss. This highlights that even patched vulnerabilities remain dangerous at scale when device owners and organizations fail to apply updates promptly.