Security researchers have discovered P7 DarkSword, a stealthier variant of the iOS exploit kit that now steals crypto wallets and keychain data. iVerify first spotted the variant in August 2026 while investigating an infection on a customer’s device.
The “P7” name comes from the threat actor’s “p7_” variable prefix in modifications to the original DarkSword code. Unlike most recent DarkSword variants, which researchers say were AI vibe-coded, P7 appears hand-crafted. As a result, iVerify notes the author “invested real effort in modifying it.”
Moreover, P7 reduces its on-device footprint and adds two-way command-and-control communication. It injects the implant into SpringBoard, which handles all communication with the attacker’s infrastructure. The system also polls for commands every 15 seconds and sends heartbeats back.
In addition, P7 extracts keychain data into JSON directly on the phone before exfiltration. Earlier variants simply copied the keychain database off the device. Furthermore, the kit now targets data from Apple Notes, Photos, and cryptocurrency wallets including imToken.
The exploit chain uses two vulnerabilities that researchers had not previously linked to DarkSword. CVE-2025-24201 involves an out-of-bounds write in WebKit that Apple fixed in iOS 18.3.2. Similarly, CVE-2025-31200 involves memory corruption in Core Audio that Apple patched in iOS 18.4.1.
| Endpoint | Description |
|---|---|
| POST /beacon | Tasking poll (every 15 seconds) |
| POST /result | Raw file exfiltration |
| POST /a | Registration |
| POST /event | Heartbeat |
| POST /u | Installed applications inventory exfiltration |
| POST /nb | Notes exfiltration |
| POST /p | Photos exfiltration |
| POST /war | Keychain + Wallets exfiltration |
DarkSword targets iOS 18.4 through 18.7, while its companion kit Coruna covers iOS 13.0 through 17.2.1. However, devices running iOS 18.7.7, iOS 26.4, and iOS 27 or later remain fully protected. Notably, iVerify found no evidence that P7 can compromise patched devices.
Additionally, multiple threat actors now use the kit. Known operators include Turkish surveillance vendor PARS Defense and Russia-aligned group Star Blizzard. Censys also linked an unknown Chinese-speaking actor to the platform. Consequently, Google’s Threat Intelligence Group reported targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.
