A new variant of the DarkSword iPhone exploit kit can sort through a victim’s saved passwords and cryptocurrency wallets directly on the phone, then check in with its operators every 15 seconds for fresh instructions. The variant, named P7 DarkSword, was disclosed by mobile security firm iVerify in a report published Thursday and detailed by The Hacker News. iVerify found it in August while investigating an infection on the iPhone of an employee of a financial institution. The firm has not disclosed further details about the victim, or which version of iOS the phone was running.
A commercial kit that escaped
DarkSword is not a single bug. It is a chain of iOS vulnerabilities that escapes the browser sandbox, escalates to kernel privileges, and injects its payload into SpringBoard, the process that runs the iPhone’s home screen and app launches. It was first publicly documented in March by Google’s Threat Intelligence Group, iVerify and Lookout, and it targets iPhones running iOS versions between 18.4 and 18.7. It was detected in the wild in November 2025.
Researchers assess that DarkSword began as a commercial product and ended up on a second-hand market, where financially motivated operators and other actors have acquired it since late 2025. Earlier reporting tied the kit to attacks aimed at Saudi Arabia, Turkey, Malaysia and Ukraine, including a Turkish commercial surveillance vendor using a fake Snapchat-themed website and a Russia-aligned actor, Star Blizzard, using fake invitation lures. In other words, the tool has already passed through several kinds of hands before P7 appeared.
What P7 changes
The name comes from a “p7_” prefix the actor used in modified code. Three changes stand out in iVerify’s analysis. First, stealth: P7 drops the debug logging earlier variants sent over HTTP requests and system logs, trims the processes it touches, and uses browser local storage to avoid trying to exploit the same device twice.
Second, the theft itself has moved onto the phone. Earlier variants copied the entire keychain database and sent it away to be processed on the attacker’s infrastructure. P7 extracts keychain data into a JSON file on the device before sending the result, and it adds dedicated functions to scan for installed wallet apps and to extract wallet data from the imToken app.
Third, the implant now holds a two-way conversation. Injected into SpringBoard, it polls its command server every 15 seconds by default, sends a heartbeat and a list of installed applications, and waits for orders. The command set runs to more than fifteen instructions, including reading and uploading individual files, recursively scanning paths, uploading photos and Apple Notes databases, enumerating app containers, running operating system commands, running arbitrary JavaScript inside the implant, changing the polling interval, and shutting the implant down.
Hand-built, in a sea of copies
One detail in iVerify’s reporting separates P7 from most of what the firm now sees. Since DarkSword leaked after its public disclosure, iVerify has observed multiple unsuccessful, likely AI-assisted attempts to update the framework, including failed efforts last month to make it work on iOS 26. The firm describes many of those bundled variants as broken, non-working attempts assembled from leaked code.
P7, by contrast, reflects significant manual development rather than simple AI-assisted modification, according to iVerify’s assessment as reported by 9to5Mac. Someone with real skill spent real time making the kit quieter, smaller and better at stealing financial data — which fits where it was found: on a finance worker’s phone.
The wider ecosystem points the same way. In separate research, Censys found open directories on five hosts exposing DarkSword and Coruna components, and described what it called an exploitation-as-a-service platform with an agent and reseller model. A copy of a production server held 11 victim recovery phrases, 179 device loot directories and a 75-account control-plane roster, Censys said, suspecting a Chinese-speaking, financially motivated operator while noting that exactly who is behind it is unknown. That cluster is separate from the P7 find, but it shows the market the kit now circulates in.
Who is actually in scope
P7 is not a new iPhone vulnerability, and it does not put every iPhone at risk. It is a payload delivered after a DarkSword compromise succeeds, and the underlying flaws are already patched: the two vulnerabilities identified in the Censys registry analysis, a WebKit flaw and a Core Audio flaw, were fixed in iOS 18.3.2 and iOS 18.4.1 respectively. The exposure window is the one DarkSword has always worked in — devices still running unpatched builds in the iOS 18.4 to 18.7 range.
It is the second reminder in a week on this site that mature attack tools keep evolving after disclosure; our coverage of the Telegram Desktop account-takeover flaw made the same point for desktop software. For iPhone owners, P7’s lesson is narrower and more practical: a leaked exploit kit does not retire when it is documented. In criminal hands, it gets a smaller footprint, a live operator, and a shopping list that starts with your passwords and your wallets.
