Three lessons from DarkSword: inside a government-grade iPhone exploit kit

Jamf Threat Labs analyzes the leaked DarkSword iOS exploit kit source code, which implements one‑click remote code execution and full sandbox escape across many device/firmware combinations (iOS 18.4–18.6.2). The leak contains unobfuscated development builds with verbose debug output, crypto-wallet targeting (indicative of financial motives), Russian-language artifacts and deployment traces, and demonstrates that government-grade exploit capabilities can proliferate beyond sophisticated operators, increasing risk to unpatched iPhone users.