Threat Brief — 2026-08-04 — Leaked iOS Exploit Kit Spreads, N-able KEV Confirmed

Executive summary. A leaked iPhone hacking framework (DarkSword) has now spread to 7–8 independent threat groups, amplifying the iOS attack surface. CISA formally added the N-able N-central auth-bypass flaw to its KEV catalog after confirmed customer compromises — patch immediately if you run N-central. Device-code phishing has surged 1,500% year-to-date, reinforcing that legacy MFA controls are increasingly bypassable via social engineering. Two novel attack vectors deserve attention: VLM-powered mobile agents expose new privilege-escalation paths, and empty cryptocurrency transactions can carry hidden C2 messaging invisible to transaction-monitoring tools.

Top items

• N-able N-central auth-bypass flaw (CVE-2026-18577KEV) formally added to CISA KEV — exploited in the wild. CISA added the high-severity authentication-bypass vulnerability to its Known Exploited Vulnerabilities catalog after N-able confirmed active customer compromises enabling account takeover. If you run N-central, treat patching as urgent — a public exploit path exists via the alternate-channel bypass. This continues a story first reported 2026-08-03 by The Hacker News. (src: CISA:KEV) · (src: The Hacker News)

• Leaked DarkSword iOS exploit framework now used by 7–8 independent hacker groups. The GHOSTBLADE-deploying DarkSword kit — accidentally leaked to GitHub — has proliferated rapidly, with multiple actors now independently exploiting it against iOS targets. This widens the iOS threat landscape well beyond a single Chinese APT. Continues a story first reported 2026-08-03 by The Hacker News. (src: SecurityLab)

• Device-code phishing up 1,500% in 2026; vishing attacks double. Newer device-code phishing techniques evade entrenched MFA controls by leveraging OAuth device-flow endpoints, leaving minimal forensic evidence. The 1,500% growth figure confirms industrial-scale adoption. Continues a story first reported 2026-07-31 by The Hacker News. (src: Dark Reading)

• Novel attack surfaces in VLM-powered third-party mobile agents. Researchers demonstrate that visual-language-model-driven mobile agents — which act as high-privilege decision-makers via screenshot perception and VLM reasoning — expose new attack surfaces where malicious apps can manipulate agent behaviour to escalate privileges or exfiltrate data. Organisations deploying or developing mobile-agent integrations should assess agent permission boundaries. (src: SeeBug Paper)

• FSF seeks to connect crypto exchanges and gaming platforms to SORM surveillance system. Russia's FSB wants direct integration of cryptocurrency exchanges and online games into SORM — the system used for lawful interception of communications. If enacted, this would expand real-time surveillance coverage over financial and gaming communications channels for Russian-operated platforms. (src: SecurityLab)

• NullReceiver technique: empty crypto transactions carry hidden C2 messages. Attackers are using zero-value cryptocurrency transfers to embed covert messages that transaction-monitoring algorithms completely miss — there's no threat signal in an empty transaction. This enables stealthy C2 or data exfiltration via public blockchains without triggering compliance or fraud-detection systems. (src: SecurityLab)

• SonicWall SMA 1000 zero-day attack anatomy detailed — VPN gateways deliver root-level backdoors. A new technical breakdown shows how the SonicWall SMA zero-day chain grants attackers root-privileged backdoor access through the same VPN gateway organisations deployed for protection, enabling INC Ransomware deployment. Continues a story first reported 2026-07-17 by Dark Reading. (src: SecurityLab)

Themes

Leaked offensive tools are proliferating faster than defensive response. DarkSword's spread to 7–8 groups within days of its GitHub leak mirrors the broader pattern of offensive-framework democratisation — from Cobalt Strike cracks to mobile-agent attack research. The window between a tool leaking and widespread abuse is compressing.

Authentication assumptions keep failing. N-able's alternate-channel auth bypass, device-code phishing's 1,500% surge, and the mobile-agent privilege model all share a root cause: systems trust a secondary authentication path that attackers can reach without triggering the primary control. Audit your alternate-channel and device-flow auth surfaces.

===