iPhone spyware variant P7 DarkSword steals crypto and Keychain data

iVerify published a report today on P7 DarkSword, a previously unseen variant of the malware tied to the DarkSword exploit chain that Google and iVerify disclosed earlier this year.

The new variant was discovered in August 2026 on an iPhone belonging to a financial institution employee, iVerify told 9to5Mac. P7 drops support for iOS 18.6 but extends compatibility to iOS 18.7, matching the range already covered by other DarkSword deployments that Google observed.

Unlike earlier versions, P7 is distributed through malicious ads in watering-hole attacks, meaning victims can be caught by browsing compromised content rather than being individually targeted, according to iVerify.

Three areas of improvement

iVerify's report says P7 DarkSword improves stealth, stability, and functionality compared to the variants it usually sees. The malware reduces logging and the number of process injections it performs, uses browser storage to avoid re-exploiting the same device, and expands its data-stealing abilities.

Those changes appear to reflect substantial work by the operators rather than simple AI-assisted modifications, iVerify told 9to5Mac. The company says P7 is much better at hiding itself and cleaning up its behavior, making previous indicators of compromise useless.

New capabilities

P7 can extract Keychain data directly on the device before sending it to attackers, instead of copying the entire Keychain database for processing elsewhere. It can also target crypto-wallet data.

The variant introduces more advanced two-way communication with command-and-control infrastructure, iVerify said. Attackers can send commands to retrieve arbitrary files, upload photos, inventory installed apps, access Apple Notes databases, collect data from individual app containers, and scan the device's filesystem.

By default, the spyware checks in with the command-and-control server every 15 seconds for new instructions. That interval can be changed remotely.

What hasn't changed

P7 DarkSword is not a new iOS vulnerability. It's a new version of the malware deployed after a successful DarkSword compromise. iVerify did not say which iOS version was running on the device where P7 was found.

Background

Earlier this year, Google and iVerify revealed two sophisticated iPhone hacking tools called Coruna and DarkSword. Both chained multiple iOS vulnerabilities to compromise devices running outdated system versions. DarkSword affected iPhones running iOS 18.4 through iOS 18.7.

Apple responded by releasing system updates for the affected older iOS versions, including iOS 15.8.7, iOS 16.7.15, and iOS 18.7.7. The company made iOS 18.7.7 available to devices that could install iOS 26, so users who chose not to upgrade to the latest version would still be protected.

At the time, Google said DarkSword was being used by multiple commercial surveillance vendors and suspected state-sponsored actors, with attacks observed against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.

• DarkSword
• iOS security
• iPhone spyware
• iVerify
• Keychain theft
• P7 DarkSword