Threats · 169 days ago

Russian APT expands to iOS to harvest iCloud credentials

Star Blizzard, a Russian state-linked APT, has adopted the DarkSword iOS exploit kit to deliver GhostBlade and harvest iCloud credentials. Proofpoint observed a March 26 spike in link-based phishing emails from compromised senders that redirected iPhone browsers to the exploit. The campaign targets government, higher education, financial, legal entities, and think tanks. This marks the group's first observed focus on Apple devices and iCloud accounts.

Timeline

• Mar 30 Reported by SecurityWeek

Sources

1 source covering this story

• SecurityWeek Mar 30

  Russian APT Star Blizzard Adopts DarkSword iOS Exploit Kit

  The state-sponsored group’s campaign has targeted government, higher education, financial, and legal entities, as well as think tanks.

Entities

• Star Blizzard

Part of the PlainSec briefing for 2026-03-31

Editions

• Briefing for 2026-03-31
• Briefing for 2026-03-30

Related stories

• China-aligned Clusters Built Redundant Persistence in Government Network
• Windows DeepLoad loader steals browser credentials and hides with AI-like junk code
• Silver Fox Uses Typosquats to Deliver AtlasCross RAT