Fake Amazon Login Pages Hide a Chinese iPhone Hacking Campaign
Researchers say a Chinese group is running more than 100 lookalike sign-in sites to attack iPhones with a leaked hacking kit called DarkSword.
Key points
- Censys identified more than 100 web properties tied to a Chinese group targeting Apple iPhones.
- The attackers are using a leaked copy of DarkSword, a ready-made hacking kit for iOS devices.
- Most of the sites pose as Amazon Web Services (AWS) sign-in pages, the login screens businesses use to reach their cloud accounts.
- The final payload has been named GHOSTBLADE and is aimed at iOS, the software that runs iPhones and iPads.
- Anyone who signs in to AWS should check the web address carefully and turn on multi-factor authentication.
A Chinese hacking group is quietly running a large campaign against iPhone users, and the trap looks almost boringly familiar: a fake Amazon login page.
The attack surface management company Censys, which scans the public internet for suspicious infrastructure, counted more than 100 web properties tied to the same unknown group. Most impersonate Amazon Web Services (AWS) sign-in screens, the pages companies use every day to reach their cloud servers. The campaign was first flagged by The Hacker News.
On the same domain as those fake login pages sits something more interesting: a copy of DarkSword, an exploit kit that leaked publicly earlier this year. An exploit kit is a pre-packaged toolbox of attacks a criminal can point at a visitor's device without writing any code themselves. This one targets Apple iPhones and iPads. Researchers are calling the final payload GHOSTBLADE. We first covered GHOSTBLADE on 3 August 2026, when Apple pushed fixes for 87 iOS flaws that this kind of kit tends to exploit.
How does the attack actually work?
Victims land on a page that looks like an AWS login. If they arrive on an iPhone, the site quietly tries to run DarkSword against the browser before showing the fake sign-in form.
Two traps on one doormat. A successful exploit gives the attackers code running on the phone. When it fails, a convincing phishing page is still waiting to steal the AWS credentials. Phishing is the old trick of dressing up a fake site as a real one so people hand over their passwords.
AWS credentials are a prized target. A stolen login can expose entire company environments: customer databases, backups, internal tools. That's the difference between authentication, proving who's signing in, and authorisation, deciding what that account can touch. Beat the first and the second becomes a formality.
Why does DarkSword matter?
It lowers the bar. Before DarkSword leaked, iOS exploit chains were the kind of thing sold quietly to governments for six or seven figures. Now a copy is circulating, and a mid-tier group with a knack for phishing pages can bolt it onto a campaign without building anything from scratch.
Censys hasn't published a specific CVE, the standard identifier assigned when a software flaw is catalogued, for the iOS bug DarkSword exploits. Leaked kits tend to work best against phones that are a version or two behind, so installing updates immediately remains the single most effective defence.
Should you worry?
If you use AWS, yes, a little. Check the address bar before typing a password and turn on multi-factor authentication (MFA) if it isn't already active. MFA, the secondary code after your password, won't stop the iPhone exploit itself, but it makes stolen credentials far less useful.
A few practical steps:
- Only sign in from a bookmark you created yourself, never from a link in an email or chat.
- Turn on MFA using a hardware key or an authenticator app, not SMS.
- Keep iPhones on the latest iOS release and restart them regularly, which clears some in-memory malware.
- For business accounts, use AWS IAM Identity Center or a single sign-on provider so the real login lives on your own company domain, making fakes easier to spot.
Censys says the campaign is still active and the infrastructure keeps growing. The fake AWS page suits this group today, but the DarkSword half of the operation doesn't depend on any particular lure. Swap the login clone, keep the exploit kit, and the whole thing runs again. That's the part worth watching.
