The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. Federal Civilian Executive Branch (FCEB) entities to urgently patch actively exploited iOS vulnerabilities tied to the DarkSword exploit kit, a sophisticated spyware framework used in cryptocurrency theft and cyberespionage campaigns since late 2025 and publicly disclosed in March 2026. The attack chains six (6) vulnerabilities to achieve sandbox escape, privilege escalation, and remote code execution (RCE) on iPhones running iOS 18.4 through 18.7. The exploit chain enables attackers to gain deep access for full device surveillance and sensitive data theft, including messages, credentials, and files. Attributed to multiple threat actors including UNC6748 (linked to Turkish surveillance vendor PARS Defense), and UNC6353 (a suspected Russian espionage group) DarkSword has been deployed alongside the Coruna exploit kit in watering-hole attacks targeting Ukrainian websites, using malware families such as GhostBlade (JavaScript infostealer), GhostKnife (data-exfiltrating backdoor), and GhostSaber (code execution and data theft). The framework is designed for stealth, wiping artifacts after execution to evade detection, making it particularly difficult to identify and reinforcing its utility in short-term espionage operations aligned with intelligence and financial objectives. CISA has added three (3) of the vulnerabilities (CVE-2025-31277, CVE-2025-43510, CVE-2025-43520) to its Known Exploited Vulnerabilities (KEV) catalog and mandated remediation within two (2) weeks, while warning that these flaws represent high-risk, frequently exploited attack vectors. Given the web-based, drive-by nature of initial access and the difficulty of detection, mitigation depends heavily on immediate patching, enabling protections such as Lockdown Mode for high-risk users, avoiding suspicious content, and maintaining continuous monitoring. This highlights the increasing sophistication of mobile threat activity and the critical need for proactive defense across both government and private sector environments. CTIX analysts urge any FCEB agencies to ensure they follow CISA’s guidance to prevent exploitation