Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS

An unknown Chinese-speaking threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most of which are fake Amazon Web Services (AWS) sign-in pages on a domain that also hosts the exploit

Report facts: Censys observed a Chinese-speaking threat actor running more than 100 web properties, largely fake AWS sign-in pages, to target Apple iOS devices using a publicly leaked DarkSword exploit kit and deploying the GHOSTBLADE malware. The campaign abuses widely trusted cloud branding and large-scale infrastructure to lure victims to exploit-hosting domains. RealGround analysis: While this incident is primarily a traditional cyber campaign, similar large-scale, cloud-themed phishing and exploit infrastructure can be used to target AI-powered SaaS and agent frontends that rely on cloud identity. Organizations should continuously red team their AI-enabled applications and authentication flows against phishing, exploit delivery, and account takeover scenarios that imitate major cloud providers.