The spy tool DarkSword for the iPhone received a new modification of the P7, which steals passwords, photos, notes and data of crypto wallets. The malware communicates with the servers of the attackers every 15 seconds and allows you to remotely control the infected smartphone.
IVerify specialists discovered the P7 during an investigation into the infection of one of the client devices in August 2026. The protection system recorded unusual activity, different from the behavior of previously known versions of DarkSword. Additional analysis of files and network infrastructure confirmed the emergence of a new modification. The company published the results of the investigation on October 8.
The main difference between P7 is the advanced data theft capabilities. The previous versions of DarkSword copied the base of the iOS keys in its entirety and sent to the server of intruders for subsequent processing. The new modification extracts saved secrets directly on the iPhone, converts the received information into JSON format and transmits to operators. Keychain key link stores passwords, credentials and other sensitive information.
The developers have added separate mechanisms for finding cryptocurrency applications and extracting their data. Researchers have discovered a dedicated team to work with the imToken wallet, as well as a function to find other installed crypto wallets. The P7 is capable of uploading photos, Apple Notes content, application files, and device information. The presence of such functions is confirmed by the analysis of the code, but the amount of actually stolen data is unknown.
After infection, malicious code is introduced into the SpringBoard system process, which is responsible for the home screen of the iPhone. From there, the spyware maintains two-way communication with the control server through the DarkSword mechanism. Every 15 seconds, the smartphone sends a request and checks whether new commands have appeared. The operator can remotely change the frequency of calls or completely stop the operation of the spy module.
At the disposal of attackers is a set of commands to view the contents of directories, read and copy files, search for information and run JavaScript directly inside the malicious process. Individual features allow you to make a list of installed applications, scan the file system, get information about network connections and upload selected documents. Thus, the P7 is not only for one-time theft of information, but also for managed data collection.
The authors of the modification tried to reduce the number of traces on the infected device. The researchers found that P7 removed some of the diagnostic records that previous versions were left in system logs and network traffic. Malware is also being introduced into fewer iOS processes. Such changes make it difficult to detect infection and reduce the amount of suspicious activity available to the means of protection.
The additional mechanism uses the local Safari browser storage to remember the attack state. Thanks to the saved marks, the malware avoids re-starting the operating chain on a device that has already been infected. The developers thereby reduce the likelihood of failures and increase the stability of the spy tool. At the same time, Safari acts as a point of entry, and further actions execute the code that has access to the system processes.
The researched DarkSword components contain modules for several iOS releases, including 18.4, 18.5, 18.6 and 18.7. Infection is possible when downloading specially prepared web content on the device without the necessary security patches. The user does not need to install the application or confirm the launch of a suspicious program. Such attacks can use compromised sites and malicious advertising.
During the investigation, iVerify discovered P7-related infrastructure, including the domains cdn.gotoiphone.com and mzpo30.cam, as well as the control nodes agdx53.cc and js.gotoiphone.com. The researchers published network signs of infection, control sums of malicious components and characteristic traces in the file system. Among them was the keychain_c2_dump.json file, in which the program temporarily saves the extracted key link data before sending.
The specialists separately drew attention to the quality of the improvements. Among the spreading variants of DarkSword, there are many modifications, supposedly created with the help of AI tools without a deep understanding of the source code. The P7 is distinctly different from such copies. According to iVerify, the developers have purposefully redesigned the information theft mechanism, reduced the number of traces and expanded remote control, demonstrating serious technical training.
The story of DarkSword began long before the appearance of P7. In March 2026, Google, iVerify and Lookout revealed the existence of an iPhone compromise kit using a chain of six vulnerabilities. Initially, such tools were used by commercial suppliers of spyware and proposed state structures. The attacks were recorded in Malaysia, Saudi Arabia, Turkey and Ukraine. Later, the source code of DarkSword was made publicly available, which greatly simplified its use by other groups.
The leak has turned a specialized surveillance tool into a basis for numerous independent modifications. Attackers no longer need to develop a full-fledged iOS chain from scratch. It is enough to place ready-made components on a controlled web server and prepare a way to attract users to an infected page. The appearance of P7 shows that individual operators are not limited to copying the published tools, but continue to improve its capabilities.
Apple has already closed vulnerabilities on which the known attacks of DarkSword are based. Released on March 24, iOS 18.7.7 from April 1 became available to additional models of the iPhone, including devices whose owners did not want to switch to iOS 26. Protection is also present in iOS 26.4 and subsequent releases. According to published materials, P7 does not use a new confirmed vulnerability to circumvent already established fixes.
iPhone owners are advised to open the settings, go to the “Main” section, then “Software Update” and install the latest available version of the system. For devices remaining on iOS 18, the minimum protected release against known DarkSword attacks is 18.7.7. Users of old models need to install current updates of the corresponding iOS branch. Additional protection against such web attacks is provided by the Lockdown Mode, although it limits some of the usual functions of the smartphone.
The scale of the P7 distribution is not yet known. iVerify confirmed the discovery of a new modification in the investigation of real contamination, but did not disclose the number of affected users and did not publicly identify the operators. There is also no evidence that the modification can infect the iPhone with current security fixes. The main risk remains for devices whose owners continue to use vulnerable versions of iOS.
IVerify specialists discovered the P7 during an investigation into the infection of one of the client devices in August 2026. The protection system recorded unusual activity, different from the behavior of previously known versions of DarkSword. Additional analysis of files and network infrastructure confirmed the emergence of a new modification. The company published the results of the investigation on October 8.
The main difference between P7 is the advanced data theft capabilities. The previous versions of DarkSword copied the base of the iOS keys in its entirety and sent to the server of intruders for subsequent processing. The new modification extracts saved secrets directly on the iPhone, converts the received information into JSON format and transmits to operators. Keychain key link stores passwords, credentials and other sensitive information.
The developers have added separate mechanisms for finding cryptocurrency applications and extracting their data. Researchers have discovered a dedicated team to work with the imToken wallet, as well as a function to find other installed crypto wallets. The P7 is capable of uploading photos, Apple Notes content, application files, and device information. The presence of such functions is confirmed by the analysis of the code, but the amount of actually stolen data is unknown.
After infection, malicious code is introduced into the SpringBoard system process, which is responsible for the home screen of the iPhone. From there, the spyware maintains two-way communication with the control server through the DarkSword mechanism. Every 15 seconds, the smartphone sends a request and checks whether new commands have appeared. The operator can remotely change the frequency of calls or completely stop the operation of the spy module.
At the disposal of attackers is a set of commands to view the contents of directories, read and copy files, search for information and run JavaScript directly inside the malicious process. Individual features allow you to make a list of installed applications, scan the file system, get information about network connections and upload selected documents. Thus, the P7 is not only for one-time theft of information, but also for managed data collection.
The authors of the modification tried to reduce the number of traces on the infected device. The researchers found that P7 removed some of the diagnostic records that previous versions were left in system logs and network traffic. Malware is also being introduced into fewer iOS processes. Such changes make it difficult to detect infection and reduce the amount of suspicious activity available to the means of protection.
The additional mechanism uses the local Safari browser storage to remember the attack state. Thanks to the saved marks, the malware avoids re-starting the operating chain on a device that has already been infected. The developers thereby reduce the likelihood of failures and increase the stability of the spy tool. At the same time, Safari acts as a point of entry, and further actions execute the code that has access to the system processes.
The researched DarkSword components contain modules for several iOS releases, including 18.4, 18.5, 18.6 and 18.7. Infection is possible when downloading specially prepared web content on the device without the necessary security patches. The user does not need to install the application or confirm the launch of a suspicious program. Such attacks can use compromised sites and malicious advertising.
During the investigation, iVerify discovered P7-related infrastructure, including the domains cdn.gotoiphone.com and mzpo30.cam, as well as the control nodes agdx53.cc and js.gotoiphone.com. The researchers published network signs of infection, control sums of malicious components and characteristic traces in the file system. Among them was the keychain_c2_dump.json file, in which the program temporarily saves the extracted key link data before sending.
The specialists separately drew attention to the quality of the improvements. Among the spreading variants of DarkSword, there are many modifications, supposedly created with the help of AI tools without a deep understanding of the source code. The P7 is distinctly different from such copies. According to iVerify, the developers have purposefully redesigned the information theft mechanism, reduced the number of traces and expanded remote control, demonstrating serious technical training.
The story of DarkSword began long before the appearance of P7. In March 2026, Google, iVerify and Lookout revealed the existence of an iPhone compromise kit using a chain of six vulnerabilities. Initially, such tools were used by commercial suppliers of spyware and proposed state structures. The attacks were recorded in Malaysia, Saudi Arabia, Turkey and Ukraine. Later, the source code of DarkSword was made publicly available, which greatly simplified its use by other groups.
The leak has turned a specialized surveillance tool into a basis for numerous independent modifications. Attackers no longer need to develop a full-fledged iOS chain from scratch. It is enough to place ready-made components on a controlled web server and prepare a way to attract users to an infected page. The appearance of P7 shows that individual operators are not limited to copying the published tools, but continue to improve its capabilities.
Apple has already closed vulnerabilities on which the known attacks of DarkSword are based. Released on March 24, iOS 18.7.7 from April 1 became available to additional models of the iPhone, including devices whose owners did not want to switch to iOS 26. Protection is also present in iOS 26.4 and subsequent releases. According to published materials, P7 does not use a new confirmed vulnerability to circumvent already established fixes.
iPhone owners are advised to open the settings, go to the “Main” section, then “Software Update” and install the latest available version of the system. For devices remaining on iOS 18, the minimum protected release against known DarkSword attacks is 18.7.7. Users of old models need to install current updates of the corresponding iOS branch. Additional protection against such web attacks is provided by the Lockdown Mode, although it limits some of the usual functions of the smartphone.
The scale of the P7 distribution is not yet known. iVerify confirmed the discovery of a new modification in the investigation of real contamination, but did not disclose the number of affected users and did not publicly identify the operators. There is also no evidence that the modification can infect the iPhone with current security fixes. The main risk remains for devices whose owners continue to use vulnerable versions of iOS.
