Web threats / iOS exploit kits
DarkSword iOS exploit kit
DarkSword is an iPhone exploit kit for iOS 18.4 to 18.7. Websites reach it through routers that send older iPhones to Coruna and iOS 18 to DarkSword. We have matched its loader on 18 sites since 17 September.
DarkSword in numbers
Since 17 September, the first DarkSword match in our records, counted on 6 November 2026. How we count.
| Sites with DarkSword code | 18 |
|---|---|
| Sites with a match in the last 30 days | 17 |
| Latest match | 6 November |
An exploit kit for iOS 18
DarkSword attacks iPhones running iOS 18.4 to 18.7 through Safari. Google, iVerify and Lookout described it in March 2026, and its code leaked days later. Other operators have served it since.
The kit runs in stages: a browser exploit, two sandbox escapes, a kernel exploit, then a final stage, pe_main.js.
The loader fetches modules as text and runs them
The loader checks the iPhone OS version in the user agent and stops unless it is iOS 18. It fetches each stage from a folder on its host with cache: 'no-store' and keeps the text in window.modules under its file name. Then it runs the entry module, 0cb19f768eb8cd92.js, through eval.
When the entry runs, the loader tells the page that opened it with postMessage({t:'cais_ds',kind:'eval_ok'}).
Routers pair it with Coruna
Both routers we have read send older iPhones to Coruna, the kit for iOS 13 to 17, and iOS 18 to DarkSword.
The lighter one, lp-router.js, ran on 72 sites from 4 October to 5 November 2026 in 17 builds. Their domains copy WhatsApp, Coupang, Hepsiburada, Mizuho Bank and the TokenPocket wallet. The comment at the top of the router names its builder: "Setup, custom development, site maintenance: Telegram @caishenge". Resold builds swap in @qqdata_ops, @rmb132 or an empty handle. One build turns DarkSword on and off through /api/v2/public/darksword-enabled.
On a fake TokenPocket wallet site, the router sends iOS 13 to 17 to Coruna and iOS 18 to a /go/<channel code> page it labels "DarkSword PE". It waits up to 120 seconds for the eval_ok message and stores a lock key, __cais_ds_eval_ok_v1, so it does not try twice. The iOS exploit kits page follows that site.
On 154.222.16[.]220, a fake Cloudflare check branded for OKX loads a routing module. It sends iOS 18.0 to 18.7 to DarkSword pages named gooll.html, lab_rce.html and lab_187.html. When the first DarkSword stage fails, the loader falls back to Coruna, and both kits report to the same panel.
C10, the route for iOS 26
The same routing module keeps a third route, C10, for iOS 19 and later. Apple went from iOS 18 to iOS 26, so C10 is the route for iOS 26.
C10 is a switch in /profiles/c10_deploy.json. On 5 November 2026 it read "enabled": false, and nothing was deployed under /C10/. Router builds from 22 October on send iOS 19 and later to /C10/b.html, and on 6 November that path returned 404 on every router host we checked.
The C10 code itself sat on two Cloudflare Pages sites, fk-94e.pages[.]dev in August and zdjz.pages[.]dev in September 2026. Its stages are named for CVE-2025-43529, CVE-2025-14174 and CVE-2026-20700, the three bugs Apple linked to one set of attacks. Its iOS 26 offset profiles carry placeholder hashes, so the offsets are generated. DarkSword router's iOS 26 route, C10, is switched off has the full read.
The kit is sold as Caishen iOS C2 V2
Two Chinese source-code markets sell a kit called Caishen iOS C2 V2. One listing names its chains as Coruna, DarkSword and C10, for iOS 13 to 19. The other, posted on 4 November 2026 for 388 USDT, sells iOS 13 to 18.7 coverage with a landing page and panel.
The 154.222.16[.]220 server uses the name C10 and its banner promises iOS 13 to 18.7. The router names @caishenge as its builder and tags its DarkSword messages cais_ds.
What we see
| Month | New sites |
|---|---|
| September | 1 |
| October | 6 |
| November so far | 11 |
Checking for a DarkSword loader
Keep the page source, every frame it opens and the scripts each frame loads. Look for:
- an iOS 18 check on
navigator.userAgentbefore any script loads - JavaScript fetched as text, stored in
window.modulesand passed toeval - an entry module named
0cb19f768eb8cd92.js cais_dsmessages and a__cais_ds_eval_ok_v1storage key- an
lp-router.jswhose comment maps iOS 13-17 to Coruna and iOS 18 to "DarkSword PE" - routers that send iOS 13 to 17 and iOS 18 to different hidden frames
/profiles/c10_deploy.json,/profiles/ios_187_gray_gate.jsonor/gooll/paths
Remove the router or frame injection and restore the changed files from a trusted deployment. Review CMS, hosting and deployment access and rotate affected credentials.