Security researchers have uncovered a sophisticated new variant of iPhone spyware capable of remotely targeting and extracting cryptocurrency wallet data, sensitive system credentials, and private user files from compromised mobile devices.
The security firm iVerify publicly disclosed the discovery of the malware, officially designated as P7 DarkSword, on Oct. 8 following an extensive technical investigation into an active mobile infection first detected in August. According to the firm’s findings, this advanced variant features specialized remote command capabilities designed to hunt down cryptocurrency applications, harvest personal photographs, record authentication tokens, and siphon off confidential system credentials without requiring direct exploitation of the targeted wallet applications themselves.
The identification of P7 DarkSword underscores an evolving and persistent threat vector for cryptocurrency holders who rely heavily on mobile devices for portfolio management and digital asset transactions. Rather than exploiting inherent vulnerabilities within popular decentralized finance apps or multi-chain wallet utilities, modern spyware frameworks are increasingly designed to compromise the underlying operating system environment. Once attackers successfully breach a device, these malicious payloads can harvest sensitive locally stored data, posing significant security risks to digital asset owners worldwide.
How the Spyware Targets Cryptocurrency Wallets
The technical analysis conducted by iVerify reveals that the P7 DarkSword variant incorporates distinct, highly targeted functions specifically engineered to identify, isolate, and exfiltrate cryptocurrency-related data from infected iPhones.
Among these capabilities is a specific function designated as wallet_scan, which systematically sweeps through compromised devices to detect the presence of installed cryptocurrency wallet applications. This scanning mechanism enables malicious operators to quickly catalog the digital assets and software environment of an infected phone, ensuring that subsequent data extraction efforts are optimized for maximum financial yield.
Following the initial discovery phase, a secondary function known as wallet_extract takes over. This feature is specifically programmed to target and collect information associated with imToken, a widely used cryptocurrency wallet application that supports multiple blockchain networks. Together, these commands provide attackers with a streamlined mechanism to locate cryptocurrency users and retrieve associated wallet files immediately after gaining unauthorized entry into a victim’s handset.
In addition to searching for specific financial applications, the spyware targets Apple’s native Keychain framework—the secure system repository used by iOS to store passwords, account usernames, wireless network credentials, and other sensitive personal information. While earlier iterations of the DarkSword spyware framework typically copied the entire Keychain database and transferred the raw file to an attacker-controlled remote server for offline processing, the P7 variant introduces a notable modification.
P7 prepares extracted Keychain information directly on the compromised device, formatting the harvested data as a JSON file prior to transmission. This technical shift changes how the malware processes intercepted credentials, potentially streamlining operations for malicious actors and granting them immediate access to actionable authentication data the moment the payload reaches their infrastructure.
The scope of the spyware’s data collection extends well beyond dedicated cryptocurrency applications. The P7 variant possesses the capability to harvest Apple Notes databases, personal photo galleries, and selected application files stored locally on the device. Because many digital asset holders store sensitive information—such as recovery seed phrases, backup passwords, or private key hints—within personal notes or photo libraries for convenience, these auxiliary data sources represent a critical security vulnerability.
However, security researchers emphasize that simply obtaining wallet files, application logs, or personal notes does not automatically grant malicious actors full control over a victim’s private keys or funds. The potential for unauthorized cryptocurrency transfers ultimately depends on the specific nature of the information successfully retrieved by the malware and whether those credentials are sufficient to bypass authorization mechanisms or multi-factor authentication protocols.
A more consequential and alarming development highlighted in the research is the spyware’s expanded remote-control architecture. Rather than relying entirely on a rigid, predetermined collection script that executes a single set of instructions upon infection, P7 maintains an active communication loop with an attacker-controlled command and control server. By default, the malware checks in with this remote server every 15 seconds, requesting dynamic instructions that can be executed in real-time on the infected phone.
Operators retain the flexibility to adjust this polling interval, search for specific files on demand, and initiate supplementary data collection activities without requiring a secondary device compromise or additional phishing interactions. Furthermore, researchers identified various internal code modifications aimed at improving reliability and evading detection. These optimizations include the elimination of certain diagnostic system logs, a reduction in intrusive process injections, and the strategic use of persistent browser storage mechanisms to prevent repeated exploitation attempts that could otherwise destabilize the infected iPhone and alert the user.
These design changes point toward a deliberate shift among surveillance operators toward more targeted, sustained, and discreet collection of sensitive information, allowing attackers to thoroughly investigate a victim’s personal and financial activities over an extended period. Despite the depth of the technical analysis, iVerify noted in its disclosure that the investigation did not document explicit cryptocurrency thefts, identify the precise number of impacted wallet users, or quantify total financial losses resulting from the P7 deployment.
Apple’s Earlier Security Fixes Face an Evolving Threat
The discovery of the P7 DarkSword variant arrives against the backdrop of an ongoing international effort to contain and neutralize DarkSword, an advanced iOS exploitation framework previously deployed by multiple commercial surveillance vendors and state-backed actors.
In March, threat intelligence researchers at Google published a comprehensive analysis revealing that earlier iterations of the DarkSword framework combined a complex chain of six distinct vulnerabilities to compromise iPhones running specific versions of iOS ranging from iOS 18.4 through 18.7. Google’s investigation tracked active surveillance campaigns targeting high-profile individuals across multiple regions, including Saudi Arabia, Turkey, Malaysia, and Ukraine. Those initial exploitation frameworks allowed attackers to leverage malicious web content to breach vulnerable devices and subsequently deploy modular software capable of extracting personal, professional, and financial records, including cryptocurrency wallet data.
Security experts emphasize that the emergence of P7 represents an evolution of the secondary spyware payloads deployed after a device has already been successfully compromised, rather than the discovery of a brand-new, zero-day vulnerability residing within Apple’s current operating system kernel.
Apple has actively addressed the underlying vulnerabilities associated with the documented DarkSword exploitation chain through successive software patches. According to the company’s official security advisories, robust system protections against the core exploit chain first began rolling out in 2025. Apple subsequently released iOS 18.7.7 on March 24, 2026, expanding availability to additional device configurations on April 1 to ensure protection for users operating on older software architectures.
Because the advanced data-harvesting capabilities uncovered by iVerify depend entirely on attackers first achieving a successful initial breach of the device, the October findings do not establish that the P7 variant is capable of autonomously bypassing the latest iOS security updates. Researchers did not publish a variant-specific assessment identifying which patched operating system versions, if any, remain vulnerable to the new spyware modules.
In light of these ongoing mobile threats, cybersecurity agencies and hardware manufacturers continue to recommend that iPhone users maintain strict software hygiene by installing the latest compatible operating system updates and enabling automatic background updates. For high-risk individuals or those facing targeted digital threats where immediate patching is not feasible, security researchers—including Google’s Threat Intelligence Group—have previously recommended enabling specialized defensive measures such as Apple’s Lockdown Mode to mitigate sophisticated remote exploitation risks.
