TA446 Uses DarkSword Exploit Kit to Target iPhone Users

TA446, a Russia-linked espionage group, has started using the DarkSword exploit kit to compromise iOS devices in a new phishing wave that abuses Atlantic Council‑themed lures.

The campaign underscores how quickly leaked iOS exploit chains can be weaponized against high‑value policy and government targets.

Unlike earlier TA446 operations that relied on password‑protected ZIP attachments delivering malware like MAYBEROBOT, this wave shifted to URL‑based delivery to funnel victims toward DarkSword.

A submission to URLScan confirmed that one TA446‑controlled domain was actively serving the DarkSword exploit kit, including the initial redirector, exploit loader, remote code execution (RCE) stage, and Pointer Authentication Code (PAC) bypass components.

On March 26, Proofpoint observed a spike in spear‑phishing emails attributed to TA446 that spoofed invitations to an Atlantic Council event and targeted government, think‑tank, higher‑education, financial, and legal organizations.

Sandboxed analysis instead received a benign Atlantic Council PDF, suggesting the threat actors applied server‑side filtering so only real iPhone browsers were exposed to the exploit chain.

DarkSword Exploit Kit

Researchers linked the DarkSword activity to the TA446 infrastructure through second‑stage and compromised redirector domains.

The key exploit‑hosting domain referenced in malware samples and scans is escofiringbijou[.]com, controlled by TA446 and tied to prior phishing operations.

Related compromised first‑stage redirectors include motorbeylimited[.]com and bridetvstreaming[.]org, which were used to bounce victims towards the exploit kit while obscuring final hosting.

Only the March 26 Atlantic Council‑spoofing activity has been tied to DarkSword so far; previous TA446 campaigns showed no evidence of using exploits or targeting Apple devices.

Proofpoint assesses that the group adopted DarkSword primarily for credential theft and intelligence collection, expanding its reach to iOS users without changing its traditional focus on policy and civil‑society targets.

DarkSword is a recently leaked iOS exploit chain capable of one‑click compromise of devices running specific iOS 18.x versions, combining Safari exploitation, RCE, PAC bypass, sandbox escape, and in‑memory implants.

In the TA446 case, researchers confirmed delivery of the redirector, loader, RCE, and PAC bypass stages but have not yet observed sandbox‑escape components being served.

Security analysts warn that DarkSword leak on GitHub and subsequent weaponization by TA446 lower the barrier for other actors to launch advanced iOS espionage campaigns.

Apple has responded by pushing security updates and issuing on‑device notifications urging users on older iOS versions to patch immediately to block web‑based DarkSword attacks.

Mitigations for iOS users

Defenders should prioritize rapidly deploying the latest iOS and iPadOS security updates, as Apple has patched the vulnerabilities exploited by DarkSword in recent releases.

High‑risk users in government, academia, NGOs, and media should treat unsolicited “event” or “roundtable” invitations with embedded links as suspicious, verifying invitations through trusted channels before clicking.

Finally, mobile threat detection and managed threat‑hunting focused on Safari exploit chains and anomalous iOS network activity will be crucial as more actors experiment with DarkSword‑style toolchains.

Email gateways and web proxies can help by blocking known TA446 infrastructure, including escofiringbijou[.]com, motorbeylimited[.]com, and bridetvstreaming[.]org, and by enforcing HTTPS inspection to detect exploit‑kit traffic patterns.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.