Malware · Vulnerabilities
P7 DarkSword iOS Exploit Kit Targets Crypto Wallets and Enables Remote Control
Researchers have found a new version of the DarkSword iOS exploit kit, called P7, which can steal crypto wallet data and lets attackers run commands on iPhones. Only one source has reported this so far.
Ross GrantUpdated 3 min read
The short version
A new hacking tool called P7 DarkSword targets iPhones. It can steal passwords and crypto wallet data, and lets attackers run commands on the phone. Only one security news site has reported this so far, so details may change as more is learned.
What happened?
Researchers have reported a new version of the DarkSword iOS exploit kit, called P7, which can steal data from crypto wallets and allows remote commands on infected iPhones. The kit chains iOS vulnerabilities to gain control. Only one outlet has reported this so far.
What is P7 DarkSword?
A new variant of the DarkSword iOS exploit kit, called P7 DarkSword, has been reported by cybersecurity researchers. According to The Hacker News (opens in a new tab), this version is designed to steal data from crypto wallets and allows attackers to send remote commands to infected iPhones. The kit is said to have a smaller on-device footprint than earlier versions, making it harder to detect.
How does the exploit kit work?
P7 DarkSword chains together several iOS vulnerabilities. This lets it escape the browser sandbox (the security barrier between apps and the operating system), escalate its privileges to gain deeper access, and inject its main payload into SpringBoard, the process that manages the iPhone's home screen and app launches. Once installed, the implant can communicate with the attacker's servers every 15 seconds, sending information and receiving commands.
The kit can:
- Steal iCloud Keychain data (passwords and other sensitive info)
- Extract data from crypto wallet apps
- Upload photos, notes, and other files
- Scan and upload information about installed apps
- Run system commands like listing files, reading device info, and scanning the device for more data
Unlike older versions, P7 processes some stolen data on the device itself before sending it out. This includes converting keychain data to a more portable format (JSON) before exfiltration.
Who is behind the attacks and who is affected?
DarkSword has been linked to several threat actors, including commercial surveillance vendors and groups aligned with Russia and China. Previous attacks have targeted users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The kit has been sold on secondary markets, which means it is now in the hands of various financially motivated attackers.
Some campaigns used fake websites (such as a Snapchat-themed site or a bogus cryptocurrency trading platform) to lure victims and deliver the exploit. There are also reports of the kit being combined with another iOS exploit kit, Coruna, to increase the range of data stolen, especially from crypto wallets.
What has changed in this version?
Researchers say P7 DarkSword is more focused on stealth and quality of stolen data. It removes certain logging features that could reveal its presence. The implant now polls for new commands more frequently and can send a wider range of data to attackers. It also uses browser storage to avoid infecting the same device twice.
Attempts have been made to update the kit for newer iOS versions, sometimes with the help of large language models (AI tools). However, many of these attempts have not worked as intended.
What should users and defenders do?
There is no direct advice from Apple or security agencies yet, as this report comes from a single secondary source. Users should be cautious about clicking on suspicious links or downloading apps from unofficial sources. Security teams should watch for signs of compromise, such as unusual outbound connections from iOS devices or unexpected access to sensitive data like keychains or wallet apps.
What is still unclear?
This story is based on a single report from The Hacker News, citing researchers at iVerify and other security firms. There is no confirmation yet from Apple or government agencies. The exact number of affected users, the full list of targeted apps, and whether the exploit works on the latest iOS versions are not yet clear.
Claimed vs confirmed
- Unconfirmed
P7 DarkSword can steal crypto wallet data and run remote commands on iPhones.
Reported by The Hacker News based on iVerify's research; not yet confirmed by Apple or agencies.
The impact
- Money
- If attackers steal crypto wallet data, victims could lose money. If confirmed, Apple could face regulatory scrutiny and possible fines under privacy laws such as GDPR, which can reach up to €20 million or 4% of annual turnover.
- Reputation
- Apple's reputation for iPhone security could be affected if the exploit is confirmed and widespread. The use of commercial exploit kits in the wild may also raise concerns for users and regulators.
- Customers
- iPhone users with crypto wallets or sensitive data are at risk if targeted. Users should avoid suspicious links and watch for security updates from Apple.
Why it matters
If confirmed, this exploit kit could put iPhone users' passwords, crypto wallets, and personal data at risk. Attackers could use it to steal money or sensitive information. Security teams and users should stay alert for updates and possible patches.
How does it work?
The P7 DarkSword kit chains several iOS vulnerabilities to escape the browser sandbox, escalate privileges, and inject a payload into the SpringBoard process. This allows it to steal data (like passwords and crypto wallet info) and receive remote commands from attackers. It processes some data on the device before sending it out, making detection harder.
Key points
- A new iOS exploit kit, P7 DarkSword, reportedly targets crypto wallets and passwords.
- The kit allows attackers to run remote commands on infected iPhones.
- It is said to be more stealthy and processes stolen data on the device.
- Only one source has reported this so far; details may change.
- Users and defenders should watch for updates and be cautious with suspicious links.
Sources
The Hacker News
Reference
