Fact-check findings

The cited evidence supports part of the claim but not all of it.

1. #7[partially supported][awaiting moderator]in section: Apple's patches and the iOS 18.7.7 backport

   “TechCrunch reports 'a researcher posted the DarkSword kit on GitHub, making it available to threat actors targeting older iPhones,'”

   reviewerTechCrunch reports that a researcher posted the DarkSword kit on GitHub, and Apple estimated roughly a quarter of active iPhones/iPads remained vulnerable.The leak and the quarter-of-devices estimate appear to come from a different TechCrunch article (March 23, 2026), not the April 1 piece cited. The exact quoted wording could not be matched in the cited article, so the quote and citation should be rechecked.
   citedtechcrunch.com/2026/04/01/apple-releases…arksword-attacks
2. #10[partially supported][awaiting moderator]in section: Targeting of crypto wallets and exchange accounts

   “no outlet reviewed documents a confirmed, named victim or a specific dollar amount of cryptocurrency actually stolen through DarkSword”

   reviewerNo outlet reviewed documents a confirmed, named victim or dollar amount stolen through DarkSword.Consistent with sources I read (BlockTempo discloses no losses), but it is a negative claim I could not exhaustively verify.
   citedwww.blocktempo.com/?p=547791

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: What DarkSword is and how it was discovered

   “GTIG states the chain 'supports iOS versions 18.4 through 18.7 and utilizes six different vulnerabilities to deploy final-stage payloads.'”

   reviewerGTIG published 'The Proliferation of DarkSword' on March 18, 2026 and says the chain supports iOS 18.4 through 18.7 using six vulnerabilities.Date, version range and CVE count match the GTIG post. GTIG does not use the term zero-click, as the page states.
   citedcloud.google.com/blog/topics/threat-inte…os-exploit-chain
2. #2[confirmed][no action needed]in section: Technical chain and the six CVEs

   “Per GTIG's own vulnerability table, three of the six, CVE-2026-20700, CVE-2025-43529 and CVE-2025-14174, were exploited as zero-days before Apple patched them.”

   reviewerThree of the six CVEs (CVE-2026-20700, CVE-2025-43529, CVE-2025-14174) were exploited as zero-days.Matches the GTIG table.
   citedcloud.google.com/blog/topics/threat-inte…os-exploit-chain
3. #3[confirmed][no action needed]in section: Threat actor attribution

   “a Turkish commercial surveillance vendor named PARS Defense, whose campaigns in Turkey and Malaysia delivered a backdoor called GHOSTSABER”

   reviewerGTIG names UNC6748 (Saudi Arabia, GHOSTKNIFE), PARS Defense (Turkey/Malaysia, GHOSTSABER) and UNC6353 (suspected Russian, Ukraine, GHOSTBLADE).Attribution and hedging ('suspected') are faithful to GTIG. CSA and Lookout/BleepingComputer quotes were not individually fetched.
   citedcloud.google.com/blog/topics/threat-inte…os-exploit-chain
4. #4[confirmed][no action needed]in section: Targeting of crypto wallets and exchange accounts

   “its data table for the GHOSTBLADE payload lists 'Financials and Transactions: Cryptocurrency wallet data' among the categories of information collected.”

   reviewerGTIG lists cryptocurrency wallet data among the categories collected by GHOSTBLADE.Confirmed.
   citedcloud.google.com/blog/topics/threat-inte…os-exploit-chain
5. #5[confirmed][no action needed]in section: Targeting of crypto wallets and exchange accounts

   “the combined toolset 'mines Photos and Notes for BIP39 recovery phrases' while targeting Bitpie, Coinbase, Exodus, imToken, MetaMask, Phantom, Trust Wallet, Uniswap and OKEx.”

   reviewerMacworld (citing Censys, Oct 9, 2026) reports the toolset mines Photos and Notes for BIP39 phrases and targets the listed wallets.Matches. Macworld says Coruna is the wallet-stealing payload, which the page's 'used together with the earlier Coruna payload' wording is consistent with.
   citedmacworld.com/article/3257479/darksword-a…pto-wallets.html
6. #6[confirmed][no action needed]in section: Targeting of crypto wallets and exchange accounts

   “SlowMist's reporting, per BlockTempo, logged 20,187 page visits, 1,187 exploit attempts, 10 successful exploits and 9 data exfiltrations across 57 devices over a 30-day monitoring window”

   reviewerSlowMist (via BlockTempo) found a variant with imToken/TokenPocket/TronLink keystore decryption and logged 20,187 visits, 1,187 attempts, 10 successful exploits, 9 exfiltrations over 30 days across 57 devices.Figures match. BlockTempo is a secondary outlet and the SlowMist primary advisory was not located.
   citedwww.blocktempo.com/?p=547791
7. #8[confirmed][no action needed]in section: Public leak and continued exploitation through late 2026

   “TechCrunch, reporting the same day, states that Apple 'has also released a new update to iOS 18 users with iPhones and iPads that are unable to run iOS 26 software,'”

   reviewerTechCrunch (April 1, 2026) says Apple released an iOS 18 update for devices unable to run iOS 26 and that it also reaches users who chose not to update.The page's quote uses 'has also released'; the article text reads 'The company has also released', which is consistent. The article says the iOS 18.7.7 release is the broader backport.
   citedtechcrunch.com/2026/04/01/apple-releases…arksword-attacks
8. #9[confirmed][no action needed]in section: Apple's patches and the iOS 18.7.7 backport

   “GTIG states Apple had patched all six DarkSword vulnerabilities by iOS 26.3.”

   reviewerGTIG says Apple patched all six vulnerabilities by iOS 26.3 and recommends Lockdown Mode where updating is not possible.Confirmed. The section is sections[3]-adjacent in the input order; this sentence is in the patches section (sections[3] of the input array is wallets, patches is the next one, so index follows the page's 5-section order).
   citedcloud.google.com/blog/topics/threat-inte…os-exploit-chain
9. #11[confirmed][no action needed]in the timeline

   “2026-04-01”

   reviewerTimeline: Apple expands iOS 18.7.7 on 2026-04-01.Date matches.
   citedtechcrunch.com/2026/04/01/apple-releases…arksword-attacks