P7 DarkSword iOS Exploit Kit Update Steals Crypto Wallet Data
Security researchers have disclosed a new variant of the DarkSword iOS exploit kit, called P7 DarkSword. According to mobile security firm iVerify, which published its findings on Thursday, the variant leaves a smaller footprint on the device, steals keychain and crypto wallet data directly on the phone, and keeps a two-way link with the attacker’s servers.
Key Takeaways
- P7 DarkSword is a new variant of an iOS exploit kit first documented in March. It is named after the “p7_” variable prefix its operator added to the original code.
- It extracts keychain data on the phone before sending it out, and it can pull data from Apple Notes, Photos and cryptocurrency wallet apps.
- The same exploit has been seen delivered through an expired analytics domain that attackers re-registered, which then infected visitors of online stores that still carried its tracking tag.
- Separate research from Censys points to a Chinese-speaking, exploitation-as-a-service operation focused on stealing crypto wallets. The people behind it have not been identified.
What Is DarkSword?
DarkSword was first publicly documented in March by Google Threat Intelligence Group, iVerify and Lookout. It targets iPhones running iOS 18.4 to 18.7 and was first detected in the wild in November 2025.
The kit chains several iOS vulnerabilities together. It escapes the browser sandbox, gains kernel-level privileges and then places its main payload inside SpringBoard, the iOS process that handles app launches and the home screen. Researchers assess it as a commercial product that ended up on a second-hand market. Since late 2025, financially motivated operators and other threat actors have acquired it.
Past attacks have targeted users in Saudi Arabia, Turkey, Malaysia and Ukraine. The actors involved include a Turkish commercial surveillance vendor, PARS Defense, which used a fake Snapchat-themed website, and a Russia-aligned group, Star Blizzard (also known as COLDRIVER), which used fake invitation lures. In August 2026, Censys described a campaign by an unknown Chinese-speaking actor that paired the kit with a fake Apple ID sign-in page.
What Is New in P7?
iVerify says P7 improves on earlier versions in several ways:
- It removes debug logging that earlier variants sent over HTTP requests and system logs.
- It uses browser local storage to avoid re-exploiting the same device.
- It extracts keychain data into a file on the phone before sending it out. Earlier versions copied the keychain database and processed it on the attacker’s servers.
- The implant sits inside SpringBoard and handles all communication with the attacker’s infrastructure.
The implant checks in with its controller every 15 seconds, sends a “heartbeat” and a list of installed apps, and can transmit iCloud Keychain information and data from Apple Notes, Photos and cryptocurrency wallets. The server’s reply carries instructions for the device, which means the attacker can direct the implant after infection. The report also notes specific extraction support for the imToken wallet app. I have left out the technical command list here, since it serves no purpose for readers trying to protect themselves.
A Leak, AI-Assisted Edits and Many Broken Copies
iVerify says that as recently as last month it saw several unsuccessful, likely LLM-assisted attempts to adapt the framework for iOS 26.x, fuelled by the kit’s leak soon after its public disclosure. The company says these variants focus on stability, stealth and the quality of stolen data.
It has also seen DarkSword bundled with another exploit kit, Coruna, on rare occasions, and calls the combination DarkCoruna. iVerify believes the attackers obtained Coruna’s source code and modified it, since it saw no sign of binary patching and found large code changes compiled into new binaries.
It also cautions that many of these bundled variants do not work. In its words, less sophisticated attackers are deploying broken copies of patched kits taken from GitHub. iVerify cannot rule out that some attackers are reverse-engineering Coruna with the help of language models, but says it has no evidence of that yet.
Delivery Through an Expired Domain
Researchers at Report URI found the P7 exploit being delivered through a domain tied to a now-defunct Czech e-commerce analytics startup. Unknown actors re-registered the domain on September 15, 2026, after it expired. Online stores that still carried the company’s tracking tag began loading malicious JavaScript.
According to security researcher Scott Helme, the script uses cloaking to show empty content to crawlers and bots. It collects device and browser details, then redirects visitors to a scam site or an online casino. One route leads to a fake cryptocurrency trading platform that quietly serves the DarkSword exploit chain.
The implant delivered this way is designed to capture SMS, contacts, call history, voicemail, photos, Apple Health data, location history, notifications, saved Wi-Fi passwords and files from more than 25 wallet apps. Helme said the recovered code appeared to be a newer build (v24) that reports to different infrastructure and targets many more wallets.
What Censys Found?
Censys identified open directories on five hosts holding components of DarkSword and Coruna. Coruna targets iPhones running iOS 13.0 to 17.2.1, and one host serves a combined package that bundles both kits. Another host appeared to be an analysis workspace where an operator was developing exploit chains for iOS 26, which neither kit covers.
The server’s exploit registry also revealed two vulnerabilities not previously documented as part of the kit:
- CVE-2025-24201: a WebKit out-of-bounds write that can let an attacker break out of the Web Content sandbox. It was fixed in iOS 18.3.2.
- CVE-2025-31200: a Core Audio memory corruption flaw that can allow code execution through a malicious media file. It was fixed in iOS 18.4.1.
Censys suspects a Chinese-speaking actor runs the cluster with the aim of stealing cryptocurrency, though it says who is behind it remains unknown. Researcher Aidan Holland described an exploitation-as-a-service model with an agent and reseller structure. A recovered copy of the production server held 11 victim recovery phrases, 179 device data folders and a 75-account roster. Censys also found a separate China-based operator running the same kit against its own server, with an added target, the BitKeep wallet.
What iPhone and Crypto Users Can Do?
This is general guidance, not part of the researchers’ findings:
- Keep your iPhone on the latest iOS version, since the vulnerabilities named above have been patched.
- Avoid opening unknown links or sign-in pages, including those that arrive through messages or online store pop-ups.
- Do not keep wallet recovery phrases in Apple Notes, photos or screenshots, because this malware targets those places.
- Consider a hardware wallet for larger holdings.
Frequently Asked Questions
What is P7 DarkSword?
- A new variant of the DarkSword iOS exploit kit, named after the “p7_” prefix in its code. It adds on-device keychain and crypto wallet theft and two-way communication with the attacker’s servers.
Which iPhones were targeted by DarkSword?
- Devices running iOS 18.4 to 18.7, according to the original documentation. The newer variants are reportedly being adapted for iOS 26.x, though iVerify says those attempts have so far been unsuccessful.
Who is behind P7 DarkSword?
- Unknown. Censys suspects a Chinese-speaking actor focused on crypto theft, but attribution is not confirmed.
