GHOSTBLADE on iOS: DarkSword Kit Leak & The Fake AWS Phishing Wave
Just caught the Censys report on a Chinese threat actor weaponizing the leaked DarkSword exploit kit. It looks like they are aggressively targeting iOS devices to deploy the GHOSTBLADE malware.
The TTPs here are interesting yet concerning. The actor has spun up over 100 web properties, mostly masquerading as fake AWS sign-in pages. Since the DarkSword kit is now public, we’re likely going to see a surge in these drive-by download attacks rather than just state-sponsored targets. The chain typically involves a WebKit exploit to escape the sandbox, followed by the kernel exploit to gain persistence.
If you manage mobile fleets, you might want to check your proxy logs for these specific domain patterns. I whipped up a quick Python snippet to scan our access logs for the spoofed domains mentioned in the report:
import re
# Regex for observed spoofed AWS domains
log_pattern = re.compile(r".*(aws-console-verify|signin-aws)\.cloud")
def scan_logs(log_file):
with open(log_file, 'r') as f:
for line in f:
if log_pattern.search(line):
print(f"[ALERT] Phishing Domain Detected: {line.strip()}")
# Usage: scan_logs('nginx_access.log')
Has anyone else seen indicators of the DarkSword landing pages in their wild traffic yet? Curious if the threat actor is rotating domains faster than we can block them.
We caught a few hits on our SIEM yesterday. The user-agents looked legitimate, but the destination IPs resolved to hosting providers known for bulletproof hosting rather than AWS endpoints.
We immediately pushed a global block via our MDM for the specific certificate hashes associated with the GHOSTBLADE payload. I’d recommend checking your MDM for 'Untrusted Developer' warnings—this malware often tries to side-load profiles.
Good catch on the regex. I've adapted it to a Kusto query for our Microsoft Sentinel environment:
DeviceNetworkEvents
| where RemoteUrl has_any ("aws-console-verify", "signin-aws.cloud")
| project DeviceName, RemoteUrl, InitiatingProcessFileName
Zero hits so far, but we are a heavy Android shop. Still, the phishing template is high-quality; users might actually fall for the AWS SSO page.
Excellent detection logic. Given that the DarkSword kit is leaked, the payload artifacts are likely static. I’ve been scanning file shares for the kit's specific HTML scaffolding using YARA.
If you have samples, this rule helps identify the staging files before execution:
yara rule DarkSword_iOS_Kit { strings: $phish_url = "aws-console-verify" nocase $loader = "function initGhostBlade" condition: all of them }
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access