TA446 Deploys DarkSword iOS Exploit Kit in Targeted Spear-Phishing Campaign

Proofpoint and other researchers attribute a March 2026 targeted email campaign to Russian state-linked APT TA446 that used the leaked DarkSword iOS exploit kit to target iPhones. Emails spoofed the Atlantic Council and attempted to deliver GHOSTBLADE (a dataminer) and MAYBEROBOT via exploit chains and password-protected ZIPs; forensic artifacts and domain evidence (VirusTotal, urlscan) link the activity to TA446. Apple issued lock-screen warnings as the leak and public availability of DarkSword risk wider, less-skilled abuse of advanced iOS exploits.