Fake Amazon Login Pages Hide a Chinese iPhone Hacking Campaign
Researchers say a Chinese group is running more than 100 lookalike sign-in sites to attack iPhones with a leaked hacking kit called DarkSword.
Key points
- Censys identified more than 100 web properties tied to a Chinese group targeting Apple iPhones.
- The attackers are using a leaked copy of DarkSword, a ready-made hacking kit for iOS devices.
- Most of the sites pose as Amazon Web Services (AWS) sign-in pages, the login screens businesses use to reach their cloud accounts.
- The final payload has been named GHOSTBLADE and is aimed at iOS, the software that runs iPhones and iPads.
- Anyone who signs in to AWS should check the web address carefully and turn on multi-factor authentication.
A Chinese hacking group is quietly running a large campaign against iPhone users, and the trap it is using looks almost boringly familiar: a fake Amazon login page.
The attack surface management company Censys, which scans the public internet for suspicious infrastructure, says it has counted more than 100 web properties tied to the same unknown group. Most of them impersonate Amazon Web Services (AWS) sign-in screens, the pages that companies use every day to reach their cloud servers. The campaign was first flagged by The Hacker News.
Sitting on the same domain as those fake login pages is something more interesting: a copy of DarkSword, an exploit kit that leaked publicly earlier this year. An exploit kit is a pre-packaged toolbox of attacks a criminal can point at a visitor's device without writing any code themselves.
This one is built for Apple iPhones and iPads. Researchers are calling the final payload GHOSTBLADE.
How does the attack actually work?
Victims are lured to a page that looks like an AWS login. If they arrive on an iPhone, the site quietly tries to run DarkSword against the browser before, or instead of, showing the fake sign-in form.
Think of it as two traps on one doormat. If the exploit works, the attackers get code running on the phone. If it fails, they still have a convincing phishing page ready to steal the AWS username, password, and any second-factor code the victim types in. Phishing is the old trick of dressing up a fake site as a real one so people hand over their credentials.
AWS credentials are a prized target. A stolen AWS login can unlock entire company environments: customer databases, backups, internal tools. That is authorisation, what an account is allowed to do, rather than authentication, proving who is signing in. The hackers only need to beat the first to abuse the second.
Why does DarkSword matter?
DarkSword matters because it lowers the bar. Until it leaked, iOS exploit chains were the sort of thing sold quietly to governments for six or seven figures. Now a copy is floating around, and a mid-tier group with a knack for phishing pages can bolt it onto a campaign.
Censys has not published a specific CVE, the standard identifier used when a software flaw is catalogued, for the iOS bug or bugs DarkSword abuses. Apple users on current versions of iOS should still install updates the moment they appear, since leaked kits tend to work best against phones that are a version or two behind.
What should ordinary users and IT teams do?
Check the address bar before typing an AWS password, and turn on multi-factor authentication (MFA) if it is not already on. MFA, the extra code or prompt after your password, would not have stopped the iPhone exploit itself, but it makes the stolen-credentials half of this campaign far less useful to the attackers.
A few practical steps for anyone with an AWS account:
- Only sign in from a bookmark you created yourself, never from a link in an email or chat.
- Turn on MFA using a hardware key or an authenticator app, not SMS.
- Keep iPhones and iPads on the latest iOS release, and restart them regularly, which clears some in-memory malware.
- For business accounts, use AWS IAM Identity Center or a single sign-on provider so the real login lives on your own company domain, making fakes easier to spot.
Censys says the campaign is still active and the infrastructure keeps growing. Expect the lure to change. The fake AWS page is convenient today, but the same group could swap it for a Microsoft 365 or Google Workspace clone tomorrow without touching the DarkSword half of the operation.
