Cybersecurity experts have uncovered a dangerous new evolution of the DarkSword iOS exploit kit known as P7 DarkSword. According to a recent report from iVerify, this updated variant is significantly more discreet than previous versions, reducing its digital footprint on infected devices while expanding its capabilities to include the direct theft of cryptocurrency wallets and sensitive keychain data. The malware achieves this by injecting itself into SpringBoard, the core process that manages an iPhone’s home screen and application launches, allowing it to operate deep within the system.
Unlike earlier iterations that simply copied large databases back to a remote server for processing, P7 DarkSword now processes stolen keychain information into organized files directly on the victim’s phone before sending them off. It also establishes a sophisticated two way communication channel with attackers, polling for new instructions every fifteen seconds. Once connected, hackers can issue remote commands to browse the file system, dump memory, capture photos from the device gallery, and scrape private notes from Apple Notes.
The tool appears to be part of a broader commercial ecosystem of exploits that leaked onto second hand markets. While originally designed to target specific versions of iOS 18, various threat actors—including state aligned groups and commercial surveillance vendors—have adapted it for campaigns across Saudi Arabia, Turkey, Malaysia, and Ukraine. Some attackers have even used deceptive tactics such as fake Snapchat themed websites or fraudulent invitation lures to trick users into triggering the exploit chain through their browsers.
Further complicating the landscape, researchers found that P7 often works in tandem with another payload kit called Coruna. Together, they create a comprehensive harvesting machine capable of stealing crypto recovery phrases and balance information from specialized wallet apps. As developers attempt to update these tools for future iOS versions using AI assistance, security firms warn that the focus has shifted toward extreme stability and stealth to avoid detection by modern mobile defenses.
