P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

Live updates

1. 52m ago

   P7 DarkSword iOS Exploit Kit Adds Crypto Theft

   Cybersecurity researchers have disclosed a previously unseen variant of the DarkSword iOS exploit kit named P7 DarkSword. Compared to standard variants, P7 features a reduced on-device footprint while introducing capabilities to steal data from the iOS keychain and more than 25 crypto-wallet applications. Additionally, the new variant establishes two-way command and control communication with attacker infrastructure, allowing operators to execute remote commands on infected iPhones.

   Why it matters

   DarkSword was originally publicly documented in March by the Google Threat Intelligence Group, iVerify, and Lookout for targeting iPhones running iOS versions 18.4 through 18.7. The malicious kit was initially detected in the wild in November 2025. This updated iteration shifts the threat profile by combining enhanced stealth with active data extraction.

   What is confirmed

   • Researchers disclosed a new variant of the DarkSword iOS exploit kit called P7 DarkSword.
   • The P7 DarkSword variant reduces its on-device footprint while adding keychain and crypto-wallet data theft.
   • The exploit kit introduces two-way command and control communication with the attacker infrastructure.
   • DarkSword was first publicly documented in March by Google Threat Intelligence Group, iVerify, and Lookout.
   • The original DarkSword kit targets iPhones running iOS versions between iOS 18.4 and 18.7 and was detected in the wild in November 2025.

   Still unconfirmed

   • Researchers traced the P7 DarkSword kit to open directories tied to a Chinese-speaking exploitation service and recovered victim recovery phrases.

   What to watch next

   • Identification of additional threat actor campaigns utilizing the P7 DarkSword variant
   • Further telemetry regarding the scope of infected iOS versions and enterprise mobile device management exposures
   Sources used for this update (25)

   1. thehackernews.com — The Hacker News | #1 Trusted Source for Cybersecurity News
   2. The Hacker News — P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
   3. iVerify — Sleep, Beacon, Steal, Repeat - The Story of P7 DarkSword Variant
   4. 9to5Mac — Researchers uncover new DarkSword spyware variant affecting unpatched iPhones
   5. Digital Trends — DarkSword returns with a nastier trick that lets hackers steal your iPhone data in real time
   6. Macworld — DarkSword and Coruna iOS exploits continue to attack crypto wallets
   7. Bhaskar English — iPhone users beware! New spyware can steal passwords and data: What is 'P7 DarkSword' malware, and how to s...
   8. coinspot.io — virus Coruna steals cryptocurrency wallet data on old iPhones
   9. CryptoRank — New iPhone spyware can hunt for crypto wallets and extract their data every 15 seconds
   10. dailysecurityreview.com — P7 DarkSword iOS Exploit Kit Variant Adds Crypto-Wallet Theft
   11. thehackernews.com — P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft ...
   12. thehackernews.com — ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
   confidence 100%