New P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Theft and Remote Commands

Researchers reveal P7 DarkSword, a new iOS exploit variant that steals crypto wallet data and enables two-way command-and-control communication.

Threat Times Exposure DeskOctober 9, 20262 min read

Share LinkedIn Reddit

Illustration: A cracked smartphone screen lies on a wooden surface, its reflection showing abstract red warning shapes and swirling data streams that suggest hidden theft of digita — AI-generated illustration: Threat Times

Key points

iVerify researchers identified P7 DarkSword as a new variant of the DarkSword iOS exploit kit.
The variant reduces its on-device footprint while adding capabilities to steal keychain and crypto-wallet data.
P7 introduces two-way command-and-control communication between the infected device and attacker infrastructure.

Cybersecurity researchers from iVerify have disclosed details regarding a previously unseen variant of the DarkSword iOS exploit kit, designated as P7 DarkSword. The findings were published in a report released on Thursday, highlighting significant functional upgrades to the malware’s capabilities compared to earlier observed versions.

According to iVerify, the P7 variant is designed to operate with a reduced on-device footprint, making it potentially harder to detect. Beyond stealth improvements, the malware now includes modules specifically engineered to steal data from the iOS keychain and cryptocurrency wallets. Additionally, the variant establishes two-way command-and-control (C2) communication with the attacker’s infrastructure, allowing for more dynamic interaction than previous iterations.

Technical Enhancements and Capabilities

The primary distinction of the P7 DarkSword variant lies in its expanded data theft mechanisms and communication protocols. Traditional variants of the DarkSword exploit kit have been observed in the wild, but this specific iteration marks a shift in operational tactics. By reducing its footprint on the device, the malware aims to evade standard detection methods that might flag larger or more resource-intensive processes.

The addition of crypto-wallet theft capabilities indicates a targeted approach toward financial gain. Accessing the iOS keychain allows the malware to retrieve sensitive credentials, passwords, and authentication tokens stored securely on the device. This access, combined with the ability to target crypto wallets, suggests that attackers are leveraging the exploit to compromise high-value digital assets directly from the user’s device.

The implementation of two-way C2 communication is a critical upgrade. Unlike one-way reporting mechanisms, two-way communication allows attackers to send commands to the infected device in real-time. This enables remote execution of commands, potentially allowing threat actors to pivot within the network, exfiltrate additional data, or deploy further payloads based on the specific environment of the compromised device.

Who Is Affected

iOS users are the primary targets of this exploit kit. The DarkSword framework has historically been associated with sophisticated attacks against Apple devices, often leveraging zero-day vulnerabilities or complex exploit chains to bypass iOS security mechanisms. While iVerify did not specify the exact user base targeted in this immediate disclosure, the inclusion of crypto-wallet theft suggests that individuals who store cryptocurrency on their iOS devices or use mobile wallet applications are at heightened risk.

Security professionals monitoring iOS threats should be aware that this variant represents an evolution in mobile malware tactics. The combination of stealth, financial targeting, and interactive C2 channels makes P7 DarkSword a more dangerous tool for cybercriminals. Organizations with mobile device management (MDM) solutions should review their threat intelligence feeds for indicators of compromise related to DarkSword variants.

What should you do?

Security teams should monitor for unusual network traffic patterns that may indicate two-way C2 communication from iOS devices. Users should ensure their devices are running the latest available iOS updates to mitigate known vulnerabilities. Additionally, individuals should audit their installed applications and avoid sideloading apps from untrusted sources, as exploit kits often rely on compromised or malicious applications for initial access. Regularly checking for unauthorized access to keychain items and crypto wallets is also advisable.

What to do and how to stay safe: DarkSword

Monitor network logs for suspicious outbound connections from iOS devices that may indicate command-and-control activity.
Keep iOS devices updated with the latest security patches provided by Apple to address potential vulnerabilities.
Avoid installing applications from unofficial sources or sideloading apps, which can be vectors for exploit kits.
Regularly review account activity for cryptocurrency wallets and other sensitive services linked to the device.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is P7 DarkSword?

P7 DarkSword is a newly disclosed variant of the DarkSword iOS exploit kit that features a reduced on-device footprint and enhanced data theft capabilities.

What new capabilities does P7 DarkSword have?

It adds the ability to steal data from the iOS keychain and crypto wallets, and it enables two-way command-and-control communication with attacker infrastructure.