iVerify Details P7 DarkSword, a New iPhone Spyware Variant That Steals Keychain and Crypto Wallet Data

A new, more capable version of the DarkSword iPhone exploit kit is out in the wild. Security firm iVerify published its findings on Thursday, Oct. 8, 2026, and named the variant P7 DarkSword.

The short version: it steals more, hides better, and lets attackers steer it in real time. The catch is that the exploit files iVerify found are built for iOS 18.

How iVerify found it

iVerify says it caught the variant in August 2026. Its monitoring flagged odd activity on a customer's iPhone, and with the customer's permission, researchers examined the device. The infection did not match the DarkSword versions the team had seen before.

Researchers then used the Validin threat intelligence platform to hunt for related code. They found another copy of the spyware sitting on suspicious infrastructure.

The "P7" name comes from the "p7_" variable prefix the attacker used in the code changes.

What P7 does differently

iVerify's own summary: "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure."

In plain English, that covers several changes:

• Live commands. By default the spyware checks in with the attacker's server every 15 seconds for new instructions. Attackers can change that interval.
• More targets. It goes after saved passwords, Apple Notes, photos, the list of installed apps, and data tied to crypto wallets, including imToken-related data.
• Keychain processing on the phone. Earlier versions shipped the whole keychain out to be cracked later. P7 sorts passwords and account data on the device first, then sends the results.
• Less noise. It skips the debug logs that exposed earlier versions and touches fewer system processes.
• No repeat infections. It uses browser storage to mark phones it has already hit, so it does not attack the same device twice.

iVerify has not reported any confirmed cryptocurrency theft or financial losses tied to P7.

Where DarkSword came from

DarkSword was documented publicly in March by Google Threat Intelligence Group, iVerify and Lookout. It targets iPhones running iOS 18.4 through 18.7 and was first detected in the wild in November 2025.

The kit chains several iOS vulnerabilities to break out of the browser sandbox, gain kernel privileges and plant its payload in SpringBoard, the process that runs the home screen and app launches. Researchers assess it as a commercial product that ended up on a second-hand market and was then acquired by financially motivated operators and other threat actors starting in late 2025.

It has been used against targets in Saudi Arabia, Turkey, Malaysia and Ukraine. Users include a Turkish commercial surveillance vendor, PARS Defense, which used a fake Snapchat-themed site, and Star Blizzard (also tracked as COLDRIVER), a Russia-aligned group that used fake invitation lures. In August 2026, Censys detailed a campaign by an unknown Chinese-speaking actor that paired the kit with a fake Apple ID sign-in page.

A skilled hand, not a copycat

iVerify says it has seen "multiple unsuccessful, likely LLM-assisted attempts to update the framework to support iOS 26.x," fueled by the kit's leak after public disclosure. It also described many bundled variants as "non-working AI slop," deployed by unsophisticated attackers using broken code from GitHub.

P7 is different, according to iVerify. The firm says its makers did real engineering work to improve it.

iVerify also told The Hacker News it has occasionally seen DarkSword bundled with another exploit kit, Coruna, in what it calls DarkCoruna. The firm said it believes those attackers obtained Coruna's source code and modified it, and that it has no evidence yet of anyone rebuilding Coruna with AI models.

Who is actually at risk

The research does not show that every iPhone is vulnerable. The exploit files iVerify found are built for iOS 18, and Apple patched the original DarkSword in iOS 26.3.1.

What iVerify has not said is whether Apple's latest fixes block P7 specifically. Apple had not issued a public statement on the variant as of the reports reviewed for this story.

That leaves a practical gap. Anyone still on iOS 18.4 through 18.7 is in the range the kit was built for. The standard advice from the researchers' findings is to update to the newest iOS 26 release through Settings, General, Software Update.

The infection path described for DarkSword is a visit to a booby-trapped website, so phones left on old software are the exposed ones. A phone that says it is up to date but sits on an older iOS branch is worth a second look.

What comes next

The open questions are Apple's: whether the company will comment on P7 and confirm that current iOS 26 builds block it. iVerify says it is still watching for attempts to port the kit to iOS 26.x, and it has so far seen those efforts fail.