[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYBQBRx2XpxOFBHBVs09JmO6PM5Rv9xn1OE0YvBS4Fjs":3},{"article":4,"iocs":53,"watch_terms":71,"solutions":72,"lesson":172},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"03c54fde-e039-42f9-b419-6fed8e339aaf","Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS","chinese-threat-actor-uses-leaked-darksword-kit-to-deploy-ghostblade-on-ios-8f03bf","An unknown Chinese-threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most of which are fake Amazon Web Services (AWS) sign-in pages on a domain that also hosts the exploit toolkit. \"","A Chinese threat actor is actively targeting Apple iOS devices using a leaked version of the DarkSword exploit kit. The actor operates over 100 fake AWS sign-in pages and domains hosting the exploit toolkit, with infrastructure spread across Hong Kong, Japan, the US, and Europe. The campaign exploits now-patched iOS vulnerabilities to deploy GHOSTBLADE, an information-stealing malware that exfiltrates credentials and data.","Chinese threat actor uses leaked DarkSword kit to deploy GHOSTBLADE on iOS.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fchinese-threat-actor-uses-leaked.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgvbg0AbgcDL8IouGo4deahk3vOuegzB-hxhUxAok05EuI5uuYJUDP-mUVS1w-gr9Oedf6JzF9qEB3l8MWVnsFGkmZ4ZorInHavwKWrQ7toTmv64uc4EnJdoFDqGlDPQsgcTwnJo8rlZyfG9yFu60fNE51Di00aVdZoiv5YMIvobc6xuWZhT_cKDk3ikV-P\u002Fs1600\u002Fapple.jpg","2026-08-03T10:49:06+00:00","2026-08-03T12:00:09.325623+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"UNC6353","threat_actor",{"name":21,"type":22},"DarkSword","product",{"name":24,"type":22},"Coruna",{"name":26,"type":27},"iOS","technology",{"name":29,"type":27},"AWS","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,64,66,68],{"type":55,"value":56,"context":57},"ip","38.181.52.95","Singapore-based host running exploit-panel front ends and Apple ID credential-harvesting decoy.",{"type":55,"value":59,"context":60},"103.106.190.217","Hong Kong host bundling Apple ID credential-harvesting decoy and C2 Control Panel.",{"type":55,"value":62,"context":63},"103.226.155.200","IP address associated with Decode Dashboard.",{"type":55,"value":65,"context":63},"103.226.155.201",{"type":55,"value":67,"context":63},"202.8.120.249",{"type":55,"value":69,"context":70},"93.152.221.37","Open directory listing in Frankfurt exposing operator's tooling.",[21,24],{"controls":73,"vendors":157},[74,103,129],{"slug":75,"name":76,"problem":77,"products":78},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":104,"name":105,"problem":106,"products":107},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":125,"product_name":126,"url":127,"description":128},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":52,"name":130,"problem":131,"products":132},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[133,141,149],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[158,164,170],{"slug":159,"name":160,"logo_path":161,"roles":162},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[163],"affected",{"slug":165,"name":166,"logo_path":167,"roles":168},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png",[169],"reported_by",{"slug":134,"name":135,"logo_path":136,"roles":171},[169],{"slug":173,"title":174,"body":175,"framework_refs":176,"framework_notes":187},"leaked-exploit-kit-targets-unpatched-ios-devices-to-deploy-ghostblade-infostealer","Leaked Exploit Kit Targets Unpatched iOS Devices to Deploy GHOSTBLADE Infostealer","A Chinese threat actor is leveraging a leaked version of the DarkSword exploit kit to compromise iOS devices through vulnerabilities that Apple has since patched, meaning victims running outdated software remain exposed. The campaign uses over 100 convincing fake AWS sign-in pages to lure targets, demonstrating how social engineering and technical exploitation are combined for maximum impact. The deployed GHOSTBLADE malware silently exfiltrates credentials and sensitive data, making delayed patching directly responsible for potential data loss. This highlights that even patched vulnerabilities remain dangerous at scale when device owners and organizations fail to apply updates promptly.",[177,178,179,180,181,182,183,184,185,186],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 9: Email and Web Browser Protections","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-18: Mobile Code","NIST AC-17: Remote Access","GDPR Article 32: Security of Processing","Apple Platform Security Guide: iOS Update Management","NIST CSF ID.RA-1: Asset Vulnerabilities Identified",{}]