P7 DarkSword iOS variant steals keychain, crypto wallets
iVerify discovered a new P7 DarkSword variant in August 2026 that extracts keychain and cryptocurrency wallet data on the device and establishes two-way command-and-control communication.
iVerify identified the P7 DarkSword malware in August 2026 during an infection investigation at a financial institution. This new variant of the DarkSword iOS exploit kit adds on-device keychain and crypto-wallet theft and enables two-way communication with attacker infrastructure. The DarkSword exploit chain, first publicly documented in March by Google Threat Intelligence Group, iVerify, and Lookout, chains multiple iOS vulnerabilities to compromise devices running versions 18.4 through 18.7.
Technical enhancements
P7 DarkSword is a previously unseen variant named for the threat actor's use of the 'p7_' variable prefix in modified code. Compared to earlier variants, it significantly improves stealth, stability, and functionality. The variant reduces its on-device footprint and eliminates debug logging over HTTP requests and syslog. It uses browser localStorage to prevent re-exploitation of the same device.
Most notably, P7 extracts Keychain data directly on the iPhone into JSON format before exfiltration, instead of copying the entire database for remote processing. The implant transmits iCloud Keychain information, data from applications like Apple Notes and Photos, and specifically targets cryptocurrency wallet data. It also introduces more advanced two-way communication with the attackers’ command-and-control infrastructure.
Capabilities and behavior
The implant sends a 'heartbeat' message and a list of installed applications to its controllers. By default, it polls for new commands every 15 seconds, though this interval can be changed remotely. The response to this poll contains a broad set of commands for extensive device control and data theft.
| Command | Function |
|---|---|
| execute_command | Executes OS commands like ls, cat, rm, ps, and whoami |
| ls | Lists directory contents |
| download | Reads a file from the device and uploads it to the C2 server |
| photos | Uploads photo files from '/var/mobile/Media/DCIM' |
| apps | Enumerates app containers and extracts bundle IDs |
| exec | Executes arbitrary JavaScript inside the implant runtime |
| file_upload | Recursively scans paths and uploads matching files |
| basic_info | Sends device metadata to the C2 server |
| disk_scan | Recursively scans the filesystem from '/', records file metadata, and uploads a report |
| ios_app_data | Finds app sandbox and app-group containers for requested bundle IDs and uploads selected app files |
| wallet_scan | Scans for installed wallet apps |
| wallet_extract | Extracts wallet-related data for the imToken wallet app |
| memo_scan | Uploads Apple Notes databases |
This two-way communication gives attackers considerable control to retrieve arbitrary files, inventory apps, access Notes, collect data from individual app containers, and scan the entire filesystem.
Distribution and targeting
DarkSword is assessed as a commercial product that landed in a second-hand market and has been acquired by various threat actors since late 2025. Google said it was being used by multiple commercial surveillance vendors and suspected state-sponsored actors, with attacks observed in Saudi Arabia, Turkey, Malaysia, and Ukraine. A Turkish commercial surveillance vendor named PARS Defense used the kit via a fake Snapchat-themed website, while the Russia-aligned threat actor Star Blizzard used it via fake invitation lures.
In August 2026, Censys detailed a campaign by an unknown Chinese-speaking threat actor targeting Apple iOS devices with the exploit kit and serving a decoy Apple ID sign-in page. Censys researcher Aidan Holland said: "The platform runs a Chinese-speaking exploitation-as-a-service operation." The threat actor behind P7 is distributing it through malicious ads as part of watering-hole attacks, meaning victims are not individually targeted but caught by encountering malicious web content.
Context and evolution
DarkSword was first detected in the wild in November 2025. The exploit chain escapes the browser sandbox, escalates to kernel privileges, and injects a payload into the SpringBoard process. Following its public disclosure, the kit leaked, fueling its proliferation. Variants since have focused on stability, stealth, and the quality of stolen data. iVerify observed multiple unsuccessful, likely LLM-assisted attempts last month to update the framework to support iOS 26.x.
The P7 variant expands compatibility to iOS 18.7, up from iOS 18.6 in an earlier variant tracked by iVerify. The changes appear to reflect substantial work by the operators rather than simple AI-assisted modifications. iVerify notes that P7 is much better at hiding itself and cleaning up its behavior, rendering previous indicators of compromise invalid.
Apple released system updates including iOS 15.8.7, iOS 16.7.15, and iOS 18.7.7 to protect against DarkSword. It took the unusual step of making iOS 18.7.7 available to devices that could install iOS 26. P7 is not a new iOS vulnerability but a new version of the malware deployed after a successful DarkSword compromise.
