Active GHOSTBLADE Campaign: Detecting Leaked DarkSword Kit Exploitation on iOS

Introduction

Security Arsenal is tracking an active and concerning campaign targeting Apple iOS devices. According to intelligence from Censys, an unknown Chinese-speaking threat actor has weaponized a publicly leaked version of the DarkSword security issue kit. This actor is currently operating over 100 web properties designed to deliver the GHOSTBLADE malware.

The attack infrastructure is sophisticated: most of these sites are counterfeit Amazon Web Services (AWS) sign-in pages. This dual-use infrastructure hosts both the phishing lure and the exploit kit. Given the prevalence of AWS in enterprise environments, the likelihood of user interaction is high. Defenders must assume active credential theft and device compromise attempts are underway against their mobile fleet.

Technical Analysis

Affected Products and Platforms

• Platform: Apple iOS (iPhone, iPad).
• Delivery Vector: Malicious web sites hosting the DarkSword exploit kit.
• Lure: Fake AWS sign-in/consent pages.

Vulnerability and Exploitation Mechanics

While this campaign relies on the DarkSword kit—a toolkit historically associated with browser-based exploits—the critical factor for defenders is the delivery chain rather than a single CVE. The DarkSword kit is used to trigger a vulnerability chain (potentially involving Safari or WebKit components) that facilitates the installation of GHOSTBLADE.

Attack Chain:

1. Initial Access: The target is directed to a malicious URL (often via phishing or a redirect from a compromised site).
2. Exploitation: The site hosts the DarkSword kit. Upon loading, the kit attempts to exploit the mobile browser to escape the sandbox.
3. Payload Installation: If successful, the device downloads and installs the GHOSTBLADE malware.
4. Persistence: GHOSTBLADE typically establishes persistence by installing a malicious mobile configuration profile (.mobileconfig) or abusing system daemons, effectively turning the device into a surveillance tool.

Exploitation Status

• Status: Confirmed Active Exploitation.
• Source: Censys has identified 100+ live web properties currently hosting this kit.

Detection & Response

The following detection rules and hunts are designed to identify the network indicators of this campaign (fake AWS pages) and the endpoint artifacts (malicious profiles) associated with GHOSTBLADE infections.

SIGMA Rules

---
title: Potential iOS GHOSTBLADE Infection Vector - Fake AWS Phishing
id: 8a3b1c92-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects access to non-standard domains hosting AWS sign-in pages, indicative of the DarkSword kit delivery infrastructure.
references:
  - https://thehackernews.com/2026/08/chinese-threat-actor-uses-leaked.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.initial_access
  - attack.credential_phishing
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|contains: 'signin'
    c-uri|contains:
      - 'aws'
      - 'amazon'
      - 'amazonaws'
  filter:
    cs-host|endswith:
      - '.amazonaws.com'
      - '.aws.amazon.com'
      - '.amazon.com'
      - '.amazoncognito.com'
  condition: selection and not filter
falsepositives:
  - Legitimate access to AWS S3 buckets hosting static sites (rare for signin)
level: high
---
title: Suspicious iOS Profile Download (GHOSTBLADE Persistence)
id: 9b4c2d03-0f5c-5e78-cd23-4f6b9g012345
status: experimental
description: Detects downloads of .mobileconfig files from the internet, often used by GHOSTBLADE for persistence on iOS.
references:
  - https://thehackernews.com/2026/08/chinese-threat-actor-uses-leaked.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.persistence
  - attack.t1641
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|endswith: '.mobileconfig'
    sc-status: 200
falsepositives:
  - Legitimate MDM enrollment
  - Wi-Fi certificate installation
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for devices interacting with the fake AWS infrastructure or downloading the persistence mechanisms.

// Hunt for interactions with fake AWS infrastructure or mobile config downloads
let FakeAWSKeywords = dynamic(['signin', 'login', 'auth', 'sso']);
let LegitimateAWS = dynamic(['amazonaws.com', 'aws.amazon.com', 'amazon.com', 'amazoncognito.com']);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any(FakeAWSKeywords) and (RemoteUrl has "aws" or RemoteUrl has "amazon")
| where RemoteUrl !has_any(LegitimateAWS)
| extend ParsedUrl = parse_url(RemoteUrl)
| project Timestamp, DeviceId, DeviceName, InitiatingProcessAccountName, RemoteUrl, ParsedUrl_Host=ParsedUrl.Host, RemoteIP
| summarize Count=count(), LastSeen=max(Timestamp) by DeviceId, ParsedUrl_Host, RemoteIP
| order by Count desc

Velociraptor VQL

Since VQL cannot run directly on iOS, this artifact is designed for macOS endpoints that manage iOS devices or sync with them. It hunts for suspicious .mobileconfig files that may have been sideloaded or synced from a compromised device, or if the malware vector affects macOS Safari as well.

-- Hunt for recent mobileconfig files which may be GHOSTBLADE profiles
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs=['/**/*.mobileconfig', '/Users/*/Downloads/*.mobileconfig'])
WHERE Mtime > now() - 7D
-- Scoped to user writable locations to reduce noise from system configs
AND FullPath NOT STARTS WITH '/System/'

Remediation Script

This Bash script assists IR teams in auditing proxy logs for the specific "fake AWS" indicators associated with this campaign to identify potentially compromised users.

#!/bin/bash
# Audit proxy logs for Fake AWS/GHOSTBLADE indicators
# Usage: ./audit_ghostblade.sh /path/to/proxy.log

LOG_FILE="$1"
if [[ -z "$LOG_FILE" ]]; then
  echo "Usage: $0 <path_to_proxy_log>"
  exit 1
fi

echo "[*] Scanning $LOG_FILE for Fake AWS/GHOSTBLADE indicators..."

# Identify lines containing 'signin' AND 'amazon'/'aws' but NOT legitimate domains
grep -iE "signin.*aws|signin.*amazon" "$LOG_FILE" | \
grep -ivE "amazonaws\.com|aws\.amazon\.com|amazon\.com" | \
awk '{print $1}' | sort | uniq

echo "[+] Unique IPs accessing suspicious infrastructure extracted."

Remediation

To mitigate the risk posed by the DarkSword kit and GHOSTBLADE deployment, Security Arsenal recommends the following actions:

1. Patch and Update: Ensure all iOS devices in the enterprise are updated to the latest version. Apple frequently patches the WebKit exploits leveraged by kits like DarkSword. Verify compliance via your Mobile Device Management (MDM) solution.
2. Block Malicious Infrastructure: Feed the list of identified 100+ web properties (if obtained from threat intelligence feeds like Censys) into your secure web gateways (SWG), DNS filters, and firewalls. Block access to domains hosting fake AWS pages.
3. Restrict Profile Installation: Enforce MDM policies that prevent users from installing configuration profiles manually. GHOSTBLADE relies on this for persistence; disabling manual profile installation neutralizes this vector.
4. User Awareness: Immediately alert workforce members to the ongoing phishing campaign targeting AWS credentials. Advise them to verify the URL carefully before entering credentials.
5. Credential Reset: If you suspect users have interacted with these fake pages, force a password rotation for AWS IAM accounts and enable MFA (if not already active).

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub