--- url: "https://www.xcademia.com/news/p7-darksword-new-ios-spyware-variant-adds-stealth-and-crypto-wallet-theft" title: "P7 DarkSword: New iOS Spyware Variant Adds Stealth and Crypto Wallet Theft" description: "iVerify uncovers P7 DarkSword, an iOS spyware variant with reduced visibility, keychain theft, crypto wallet targeting and remote command capabilities." publishedAt: "2026-10-10T10:52:44.137+00:00" updatedAt: "2026-10-12T02:12:33.912136+00:00" type: news category: cybersecurity source_name: iVerify Threat Intelligence Team source_url: "https://www.iverify.com/blog/darksword-variant-threat-research" tags: - "#DarkSword" - "#iOSSecurity" - "#MobileSpyware" - "#CyberThreatIntelligence" - "#MobileSecurity" - "#IncidentResponse" - "#ThreatHunting" --- # P7 DarkSword: New iOS Spyware Variant Adds Stealth and Crypto Wallet Theft > iVerify has identified P7 DarkSword, a modified iOS spyware variant that reduces its on-device footprint, targets keychain and cryptocurrency wallet data, and supports two-way communication with attacker infrastructure. Source: **iVerify Threat Intelligence Team** · 10 October 2026 iVerify researchers have identified a previously unseen variant of the DarkSword iOS spyware framework that introduces changes to stealth, data theft and remote command execution. Named **P7 DarkSword**, the variant was discovered during an investigation into a suspected infection in August 2026. In a technical report published on 8 October 2026, iVerify's Threat Intelligence Team explained how the variant reduces its on-device footprint, extracts keychain information locally, targets cryptocurrency wallet data and maintains two-way communication with attacker-controlled infrastructure. The investigation highlights how modifications to an existing spyware framework can expand its capabilities without requiring an entirely new attack platform. ## What Is P7 DarkSword? P7 DarkSword is a modified variant of the DarkSword iOS exploit and spyware framework. According to iVerify, the name comes from the `p7_` variable prefix found in the modified code. The researchers identified the variant after receiving an alert about a DarkSword infection on a customer's device in August 2026. With the customer's consent, the team conducted an incident response investigation and collected additional forensic evidence. The investigation revealed suspicious files in the device's `/private/var/tmp` directory. Researchers subsequently recovered a spyware sample and compared its characteristics with known DarkSword activity. In parallel, iVerify used the Validin platform and custom tooling to search for related Coruna and DarkSword variants. By correlating filesystem artefacts from the infected device with results from this wider investigation, researchers isolated the previously unseen variant. The team also identified a suspicious domain associated with the suspected infection timeline. Analysis of the code showed changes that went beyond those seen in many other variants the researchers described as AI-assisted. iVerify concluded that the P7 authors had made deliberate modifications that reduced the implant's footprint while extending its data-theft capabilities. ## Three Major Changes in the P7 Variant The report identifies three principal areas of improvement: stealth, stability and functionality. ### 1. Reduced visibility on the infected device P7 DarkSword removes debug logging associated with HTTP requests and system logging, while reducing the number of process injections. These changes reduce some of the observable activity that investigators could use to identify the implant. Fewer process injections and less logging can also complicate forensic analysis. However, the report does not establish that the variant is completely undetectable. Its documented filesystem artefacts, network traffic and other behavioural indicators can still provide evidence for investigation. ### 2. Browser storage helps prevent repeated exploitation The variant uses browser `localStorage` to track its state and prevent re-exploitation. This mechanism is intended to stop the exploit from repeatedly running against a device that has already passed through the relevant stage. The report identifies several storage variables associated with this behaviour. The use of browser storage is a notable implementation detail because it connects the exploit's execution state to data maintained by the browser. ### 3. Expanded keychain and wallet theft The third change concerns the handling of sensitive information. Earlier DarkSword versions described by iVerify copied and exfiltrated the keychain database for processing on attacker infrastructure. P7 instead extracts keychain information into JSON on the device before sending it out. The variant also includes functionality for cryptocurrency wallet discovery and extraction. The report identifies a dedicated handler for wallet-related data associated with the imToken wallet application. These modifications give the operator additional ways to collect sensitive information from an infected device. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791629456268-info1--119-.webp) ## How P7 DarkSword Communicates With Its Operators A significant part of the report concerns command-and-control, commonly abbreviated as C2. This is the communication channel through which an implant receives instructions from an operator and returns information collected from the device. According to iVerify, the P7 implant is injected into the SpringBoard process, which handles communication with the attacker's infrastructure. The report documents several HTTP POST endpoints, each associated with a different operational function. Endpoint Reported purpose `/beacon` Polls for tasks and receives commands `/result` Transfers raw files `/a` Registers the implant `/event` Sends heartbeat information `/u` Exfiltrates installed-application inventory `/nb` Exfiltrates notes `/p` Exfiltrates photos `/war` Exfiltrates keychain and wallet data The `/beacon` endpoint is particularly important. The researchers observed requests every 15 seconds, although the polling interval can be changed through a command from the C2 infrastructure. The server's response can contain instructions for execution on the infected device. The implant also supports commands for collecting files, scanning directories, inspecting application containers, retrieving photos and gathering device information. This functionality gives the operator a flexible way to request different categories of information after the implant is active. The researchers also documented the use of HTTPS without strict certificate validation. Although HTTPS encrypts network traffic in transit, weak certificate validation can undermine confidence that the connection is communicating with the intended server. The distinction matters because encryption alone does not establish that a remote endpoint is trustworthy. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791629519904-info2--120-.webp) ## Indicators of Compromise: What Investigators Can Look For iVerify published network and filesystem indicators that security teams can use to investigate suspected P7 DarkSword infections. Indicators of compromise, or IOCs, are observable details that may help defenders identify malicious activity. They are useful for threat hunting and incident response, but a single indicator does not necessarily prove that a device is compromised. ### Network indicators The report lists the following exploit and command-and-control addresses: - `hxxps://cdn[.]gotoiphone[.]com` - `hxxps://mzpo30[.]cam/assets/js/group[.]html` - `hxxps://agdx53[.]cc` - `hxxps://js[.]gotoiphone[.]com/ios18` These addresses have been defanged, meaning their formatting has been altered to reduce the risk of accidental access. Security teams should validate indicators against current threat intelligence and their own investigation context before taking action. iVerify also documents HTTP request characteristics, including a hardcoded Safari-style user-agent string and specific request formats associated with the implant's endpoints. ### Filesystem indicators The researchers identified several files associated with the variant's collection and processing activity. File path Reported significance `/private/var/tmp/keychain_c2_dump.json` Keychain data dump `/private/var/tmp/keychain_c2_dump.json.tmp` Temporary keychain dump `/private/var/tmp/keychain_c2_dump.done` Marker indicating dump readiness `/private/var/tmp/p7_debug.log` Progress journal for the P7 keychain-theft phase `/private/var/tmp/c2_wallet_debug.log` Trace associated with keychain decryption `/private/var/tmp/notes.sqlite` Copy of an Apple Notes database `/var/mobile/ios_disk_scan.txt` Output associated with filesystem scanning The report also lists browser `localStorage` variables, exploit-component hashes and hashes of extracted implant components. These details can support more precise searches across forensic images, endpoint telemetry and available security logs. Organisations conducting investigations should refer to the original iVerify report for the full indicator set rather than relying only on the examples in this article. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791629542183-info3--119-.webp) ## How P7 DarkSword Fits Into the Wider DarkSword Threat P7 is part of a broader DarkSword threat landscape that has attracted attention from multiple security research organisations. In a separate report published on 18 March 2026, Google's Threat Intelligence Group described DarkSword as an iOS exploit chain used by multiple threat actors in distinct campaigns. Google reported activity targeting devices running iOS versions 18.4 through 18.7 and identified three malware families deployed after successful compromise: GHOSTBLADE, GHOSTKNIFE and GHOSTSABER. Google also described six vulnerabilities used by DarkSword to achieve full device compromise. Apple addressed the relevant vulnerabilities through security updates, with the complete chain remediated by iOS 26.3, according to Google's report. These findings provide useful background for understanding the significance of iVerify's P7 investigation. However, the two reports address different aspects of the threat. Google's research examines the broader exploit chain and campaigns, while iVerify's October report focuses on the specific modifications and observable artefacts associated with P7. The available findings should not be treated as evidence that every DarkSword variant has identical capabilities or that every affected device has been exposed to P7. ## What Organisations Should Do The P7 investigation highlights the importance of mobile endpoint security, timely patching and forensic readiness. ### 1. Keep iPhones updated Organisations should maintain a process for applying supported iOS security updates promptly. Google's DarkSword research identifies iOS 26.3 as the release that completed remediation of the vulnerabilities in the documented exploit chain. IT teams should verify device versions and confirm that managed devices are receiving current security updates. ### 2. Investigate suspicious mobile activity Security teams should correlate available network, device and forensic evidence rather than depending on a single indicator. The filesystem artefacts and communication patterns published by iVerify can inform threat-hunting activities. Their applicability should be validated against the organisation's environment and the latest threat intelligence. ### 3. Review mobile endpoint visibility The reduction of debug logging and process injections in P7 illustrates why defenders should consider whether their existing controls provide adequate visibility into mobile devices. Organisations should assess their ability to investigate suspicious device behaviour, collect forensic evidence and escalate incidents involving potentially compromised endpoints. ### 4. Protect sensitive information stored on devices The variant's keychain and wallet collection capabilities reinforce the need to understand what sensitive information is accessible from managed devices. Organisations should review mobile data-handling policies, credential protection and the exposure of business applications on potentially compromised devices. ### 5. Prepare an incident response process A documented response process should cover device isolation where appropriate, evidence preservation, investigation, recovery and credential or account remediation when exposure is confirmed. The correct response depends on the evidence collected and the organisation's operational requirements. The iVerify report does not provide a universal remediation procedure for every possible P7 infection. ## Analysis: Why the P7 Findings Matter The most important aspect of P7 DarkSword is not simply that another spyware variant has appeared. It is that the operators modified an existing implant to reduce some of its observable activity while extending its collection capabilities. This reflects a broader cybersecurity challenge: defenders must account for changes in attacker tooling after an initial exploit has been identified. Detection strategies based on a narrow set of artefacts may become less reliable as variants evolve. The report also demonstrates the value of combining incident response with broader threat hunting. In this case, evidence from an individual customer investigation helped researchers identify related activity and recover a previously unseen sample. For enterprises, this could mean that mobile security programmes need to treat smartphones as important endpoints in their own right, especially when those devices have access to business applications, credentials and sensitive information. These are implications drawn from the documented findings, not evidence that every organisation is affected by P7 DarkSword. ## Conclusion P7 DarkSword demonstrates how modifications to an existing iOS spyware framework can improve stealth, introduce more targeted data collection and support flexible remote tasking. iVerify's investigation provides defenders with technical details covering the variant's behaviour, communication endpoints and filesystem artefacts. Those findings can support threat hunting and incident response, while Google's earlier DarkSword research provides broader context on the exploit chain and its use by different threat actors. For security teams, the practical priority is to maintain updated devices, strengthen mobile endpoint visibility and investigate suspicious activity using multiple sources of evidence. ## Original source https://www.iverify.com/blog/darksword-variant-threat-research ## Tags `#DarkSword` · `#iOSSecurity` · `#MobileSpyware` · `#CyberThreatIntelligence` · `#MobileSecurity` · `#IncidentResponse` · `#ThreatHunting` --- ## About this content This Markdown news article is the citation-grade twin of [P7 DarkSword: New iOS Spyware Variant Adds Stealth and Crypto Wallet Theft](https://www.xcademia.com/news/p7-darksword-new-ios-spyware-variant-adds-stealth-and-crypto-wallet-theft). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/p7-darksword-new-ios-spyware-variant-adds-stealth-and-crypto-wallet-theft - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt