Trellix Details DarkSword, JSCeal, Axios npm Attack and APT28 Campaigns
HackRead, Monday, September 14th, 2026
Hackread breaks down Trellix's SecondSight report on DarkSword iOS exploits, JSCeal, an npm supply chain attack and APT28.
Hackread reports on the latest SecondSight Threat Hunting Report from Trellix's Advanced Research Center, covering activity observed between 1 January and 30 June 2026.
The headline finding is a DarkSword iOS exploit campaign in which attackers impersonated a think-tank president and sent four emails in 66 minutes to senior officials at NATO-aligned organisations, chaining six CVEs across dyld, WebKit and JavaScriptCore to compromise iOS 18.4 through 18.7 without user interaction.
Trellix attributes the campaign with high confidence to a Russian actor consistent with Star Blizzard. The report also documents JSCeal malware hiding inside Node.js, an Axios npm supply chain attack and further APT28 activity.