A Leaked iPhone Exploit Kit Gets Stealthier and Starts Taking Orders: The P7 DarkSword Briefing
A new version of the DarkSword iPhone exploit kit steals keychain and crypto wallet data, takes remote commands, and has even been served through an expired shopping-analytics domain still embedded on online stores.
DarkSword, an exploit kit that breaks into iPhones through the browser, has a new and more dangerous offshoot. Researchers call it P7 DarkSword. It leaves fewer traces on the phone, pulls passwords and crypto wallet data on the device itself, and can now receive commands from its operators instead of just sending data out.
This briefing draws on Ravie Lakshmanan’s report for The Hacker News, which pulls together new findings from iVerify, Report URI and Censys.
The short version
- What it is: a reworked variant of DarkSword, an exploit chain that escapes the browser sandbox, gains kernel-level control and plants its main payload inside SpringBoard, the iOS process behind the home screen and app launching.
- Who reported it: mobile security firm iVerify, in a report published Thursday.
- Where the name comes from: the operator’s habit of prefixing its code changes with “p7_”.
- What’s new: a smaller footprint on the device, keychain and crypto wallet theft performed on the phone, and two-way communication with the attacker’s servers.
How we got here
Google Threat Intelligence Group, iVerify and Lookout first documented DarkSword in March, describing attacks on iPhones running iOS 18.4 through 18.7. It had been spotted in the wild in November 2025. Researchers believe it began as a commercial product that ended up on a secondhand market, where financially motivated groups and others picked it up from late 2025 onward. It has been used against targets in Saudi Arabia, Turkey, Malaysia and Ukraine, including by a Turkish surveillance vendor and by the Russia-aligned group known as Star Blizzard. After the kit leaked, iVerify says it saw several failed, likely AI-assisted attempts last month to make it work on iOS 26.
What P7 can do once it’s on a phone
The implant checks in with its operators every 15 seconds. It reports which apps are installed and sends iCloud Keychain contents along with data from Apple Notes, Photos and cryptocurrency wallet apps. Earlier versions copied the whole keychain database off the phone to be processed later. P7 converts the keychain into a structured file on the device first, then sends it. It also drops the debug logging older builds left behind and uses browser storage so the same phone isn’t exploited twice.
Commands it accepts include running system commands, listing and downloading files, uploading photos, scanning the whole file system, pulling data out of specific apps, finding wallet apps and extracting data from one named wallet app, collecting Notes databases, and changing or stopping its check-in schedule.
The twist: an abandoned analytics domain
Report URI found the exploit being delivered through a domain that once belonged to a defunct Czech e-commerce analytics startup. Someone re-registered it on September 15, 2026 after it expired. Online stores that never removed the old tracking tag were suddenly loading the attacker’s JavaScript. That script hides from crawlers and bots, profiles each visitor, and redirects people to scam or casino sites. One path leads to a fake crypto trading site that delivers the full DarkSword chain, with an implant built to collect texts, contacts, call history, voicemail, photos, health and location data, notifications, saved Wi-Fi passwords and files from more than 25 wallet apps.
The bigger ecosystem
Censys found five servers hosting parts of DarkSword and a companion iPhone kit called Coruna, which targets iOS 13.0 through 17.2.1. Operators run the two together, and iVerify has occasionally seen them bundled. One server showed an operator working on exploits for iOS 26 that neither kit covers. Censys described a Chinese-speaking exploitation-as-a-service operation with a reseller model; a copy of its production server held 11 victim recovery phrases and 179 device loot folders. Censys also tied two previously undocumented CVEs to the kit: a WebKit flaw fixed in iOS 18.3.2 and a Core Audio flaw fixed in iOS 18.4.1. Who is ultimately behind the operation is not known.
What this means for your company
Company phones and personally owned phones that open work email hold passwords, MFA apps and sensitive messages. A kit that lands from an ordinary-looking web page, including a legitimate store carrying a stale script, is a reminder that mobile devices need the same discipline as laptops.
- Enforce current iOS versions on every phone that touches company data, and block or restrict devices that fall behind.
- Use mobile device management so you can see OS versions, push updates and wipe a lost or compromised phone.
- Audit your own website’s third-party scripts. Remove tags for services you no longer use. An expired domain in your page code can be bought by anyone.
- Keep crypto and high-value credentials off general-purpose phones where possible, and protect key accounts with phishing-resistant MFA.
- Consider a mobile threat detection tool for executives and finance staff, who are the most attractive targets.
Need help getting your company’s phones updated, managed and protected without slowing your team down? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
