The Second Exploit Kit

DarkSword, a second nation-state-grade iOS exploit kit, has been disclosed — this one targeting current iOS versions (18.4–18.7) with six vulnerabilities including four zero-days, deployed by three separate operators since November 2025. Unlike Coruna which targeted legacy iOS, DarkSword compromises fully patched modern devices. A critical SharePoint deserialization flaw (CVE-2026-20963) patched in January is now confirmed actively exploited. Formal guidance was issued to harden Microsoft Intune after the medical technology wiper, with the confirmed device count revised to ~80,000. The GlassWorm supply chain campaign escalated across npm, Open VSX, and GitHub simultaneously, now using Solana blockchain for C2 and in-memory-only execution.