Indicators of compromise · GHOSTBLADE — 3 shown
0d066f4a16eb2463dc340e84c2cba87ea848ab3fdb40ef693e12aed87c75a9ba8490b683504ae8653fd74a97e2dd19cf436dc7aeef57e1c40c1d2394552e43c0c48d63f1
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
Summary
An unknown Chinese-speaking threat actor is running a campaign targeting iOS devices using a publicly leaked version of the DarkSword exploit kit. Censys identified the actor running more than 100 web properties, mostly fake AWS sign-in pages on a domain hosting the exploit toolkit.
Details
Hosting concentrates in Hong Kong but reaches into Japan, the United States, and Europe. DarkSword is a full-chain exploit kit previously used by commercial surveillance vendors and suspected state-sponsored actors targeting Saudi Arabia, Turkey, Malaysia, and Ukraine since November 2025.
Sources
- The Hacker News
- Censys