Mobile security firm iVerify has described a new variant of the DarkSword iPhone exploit kit that it calls P7 DarkSword, after the “p7_” variable prefix the attacker added to the original code. Compared with variants iVerify usually sees, P7 leaves less on the phone, steals iCloud Keychain and crypto-wallet data directly on the device, and adds two-way communication with the attacker’s servers. DarkSword was first documented in March by Google Threat Intelligence Group, iVerify and Lookout; it chains several iOS flaws to escape the browser sandbox, gain kernel privileges and inject its payload into SpringBoard, the process that runs the home screen. We covered earlier DarkSword campaigns in TA446 uses leaked DarkSword iOS kit and Apple expands iOS 18.7.7.
Once running, the P7 implant polls its operator every 15 seconds for commands, including running system commands, listing and downloading files, uploading photos and Apple Notes databases, scanning for wallet apps and extracting imToken wallet data. Separately, Report URI researcher Scott Helme found that the expired domain of a defunct Czech e-commerce analytics product was re-registered on September 15, 2026. Online stores that still carry its tracking tag now load malicious JavaScript that redirects visitors to scam sites or casinos and, in one route, to a fake crypto trading site serving the DarkSword chain. The implant recovered there targets files from more than 25 wallet apps. Censys also found open directories on five hosts holding DarkSword and Coruna components, including a combined “DarkSword Fusion” bundle. iVerify says many bundled variants circulating from GitHub are broken, but P7 is a working evolution.
How to check if you’re affected
Affected devices are iPhones and iPads running iOS versions between 18.4 and 18.7, the range THN reports DarkSword targets. Open Settings > General > About to see your version, then Settings > General > Software Update to install the latest iOS release available for your device; Apple’s 18.7.7 update already extended DarkSword protections to more devices.
- Keep Automatic Updates switched on so future fixes install without delay.
- Be wary of unfamiliar crypto trading sites and links in invitations or messages; the exploit chain is delivered through web pages.
- If you hold cryptocurrency on an iPhone you suspect was exposed, move funds to a new wallet created on a clean device and rotate passwords stored in iCloud Keychain. This is a cautious precaution, not a step the researchers prescribe.
- Site owners: remove tracking tags for services that no longer exist, since an abandoned domain can be re-registered and used against your visitors.