![[FBM] CARDS](https://cpa.rip/wp-content/uploads/cr-a1/fbm-cards-v1/fbm-cards-logo.svg){kind=logo}
We spoke with the team at Kaminari Ad about the DarkSword exploit. They handle automated ad moderation before publication and while ads are running, which means they can catch substitutions and landing page manipulations as they happen.
They shared their statistics with us. From late August through early November 2026, they caught more than 5,000 attempts to buy traffic to infected sites from their clients. Their clients include major teaser networks and direct publishers.
The DarkSword exploit kit attacks iPhones running iOS 18.4-18.7. A phone becomes infected when you open an infected page in Safari. On March 19, 2026, it was first described by researchers at Google Threat Intelligence Group together with Lookout and iVerify, and part of the code was published on GitHub in late March.
How Often DarkSword Was Detected: Weekly Trends
The Kaminari Ad team began detecting it on August 20, 2026. Until mid-September, it triggered 80 to 144 times per week. In October, that figure had already reached 410-437 times, and during the week of November 2-8, it triggered 1,476 times. By November 12, there had been around 5,400 detections in total, including 1,898 from November 1-12. In the last three to four days before November 12, the exploit was distributed by 39 hosts.
The growth is explained by two factors: an increase in attempts to buy traffic for the exploit, and more accurate detection by Kaminari Ad.
RomanPMM, Kaminari Ad
“We are constantly improving our detection methods, so we find things that were previously not visible. Fraud mechanics themselves are evolving too. So it is a combination of factors: we are becoming more technologically advanced and catching more.”
Top 10 Countries Where DarkSword Was Detected
Somewhat surprisingly, the United States ranks first among the target countries for the DarkSword exploit, followed by the three largest European economies, then everyone else.
In numbers, it looks like this: the United States had 566 detections, Germany 431, France 423, and the United Kingdom 421. Next come India, Spain, Brazil, Japan, the Netherlands, and Turkey, while the remaining 121 countries accounted for around 2,000 detections.
How Kaminari Ad First Found the Exploit in Ad Creatives
We asked Roman from Kaminari Ad how they came across DarkSword.
RomanPMM, Kaminari Ad
“One of our partners regularly checked their ad creatives through Kaminari Ad. Technically, everything looked clean, but the partner noticed something unusual: budgets and the number of advertisers had risen sharply. New advertisers were arriving with offers that looked legitimate at first glance. The partner suspected something was wrong with them and came to us with a question.
We analyzed these ad creatives and found an iOS exploit in them: the page looked like a regular storefront, while the malicious code arrived through a subrequest. After that, we assigned the finding a separate iOS Browser Exploit Attempt tag in Kaminari Ad and began checking ads from other partners to warn them and keep this scheme out of their traffic.
Standard moderation based on screenshots and page topic does not see this type of scheme: the storefront is clean, while the exploit arrives in a separate request.”
You can see what these pages were disguised as in Kaminari Ad data for the week of October 21-27: among alerts with a known topic, adult had the most (140), followed by crypto and finance (85), then watches and gold (29), and dating (23). Another 170 of roughly 450 alerts had no topic listed in the report.
Be sure to read Maria’s story, whose $16,000 in crypto was stolen from an iPhone running iOS 18.
Comments