Cybersecurity researchers have disclosed technical details regarding a previously undocumented and highly sophisticated variant of the DarkSword iOS exploit kit, which is now being tracked as P7 DarkSword. The discovery highlights the continued evolution and commercial proliferation of advanced mobile exploitation frameworks that have found their way into the hands of financially motivated threat actors, state-sponsored entities, and cybercrime syndicates alike.
According to a detailed threat intelligence report published by mobile security firm iVerify, the newly uncovered P7 DarkSword variant introduces significant architectural upgrades over previous iterations. Compared with the variants typically observed by security analysts in the wild, P7 successfully reduces its on-device operational footprint, incorporates sophisticated capabilities for stealing on-device keychains and cryptocurrency wallets, and establishes a robust two-way command-and-control (C2) communication channel with the attacker’s remote infrastructure.
The designation "P7" was chosen by researchers as a direct nod to the threat actor’s distinct usage of the "p7_" variable prefix found throughout modifications made to the core codebase of the original DarkSword toolkit.
The baseline DarkSword exploit kit was first formally documented earlier this March by a coalition of security researchers, including the Google Threat Intelligence Group (GTIG), iVerify, and Lookout. Initial findings detailed the kit’s formidable ability to target Apple iPhones running iOS versions ranging between iOS 18.4 and 18.7. Telemetry data indicates that the exploit kit was initially detected in the wild as early as November 2025.
The toolkit is engineered to systematically chain multiple iOS vulnerabilities together in order to escape the strict confines of the mobile browser sandbox, escalate privileges up to the kernel level, and ultimately inject its primary malicious payload directly into SpringBoard, the core system process responsible for managing application launches and rendering the iOS home screen. Industry assessments strongly suggest that the exploit chain originated as a commercial surveillance product before somehow leaking into the secondary digital market. From there, it was acquired by various financially motivated operators and cyber espionage groups starting in late 2025.
Since its appearance, the DarkSword exploit kit has been deployed in targeted campaigns across multiple geographic regions, including Saudi Arabia, Turkey, Malaysia, and Ukraine. Notable threat actors utilizing the framework have included a Turkish commercial surveillance vendor known as PARS Defense—which deployed the kit via a deceptive, fake Snapchat-themed website—and a Russia-aligned threat actor tracked as Star Blizzard, also known as COLDRIVER, which utilized social engineering tactics involving fraudulent invitation lures.
Furthermore, in August 2026, attack surface management platform Censys detailed a separate campaign mounted by an unknown Chinese-speaking threat actor. This operation involved targeting Apple iOS devices with the exploit kit while simultaneously serving an authentic-looking Apple ID decoy sign-in page to capture user credentials.
As recently as last month, iVerify reported observing multiple unsuccessful, likely large language model (LLM)-assisted attempts by various actors to update the framework to support newer operating system versions like iOS 26.x, a trend directly fueled by the wider leak of the exploit kit following its initial public disclosure. Mobile security experts noted that these experimental variants are overwhelmingly focused on improving system stability, enhancing stealth, and maximizing the quality and volume of stolen data.
On rare occasions, researchers have also observed DarkSword and another mobile exploit kit, known as Coruna, bundled together in combined deployments referred to as DarkCoruna. According to iVerify, threat actors frequently obtain the source code for the Coruna exploit kit and heavily modify it, noting a complete absence of basic binary patching in favor of extensive code rewrites compiled into entirely new binaries.
While many of the bundled variants encountered by security analysts amount to little more than non-working, AI-generated attempts by unsophisticated actors deploying broken code from public repositories like GitHub, researchers caution that the possibility of advanced operators successfully reverse-engineering and re-implementing complex mobile frameworks with the assistance of artificial intelligence remains a persistent threat.
The P7 DarkSword variant represents a clear evolutionary leap by eliminating noisy debug logging over HTTP requests and system logs, while cleverly leveraging browser localStorage mechanisms to prevent redundant re-exploitation of target devices. Unlike older variants that simply copied and exfiltrated the entire keychain database for offline processing on attacker-controlled infrastructure, this new version extracts targeted keychain data directly into structured JSON format on the physical phone prior to exfiltration.
The core implant is injected directly into the SpringBoard process, which subsequently manages all ongoing communication with the attacker’s command-and-control infrastructure. The latest iteration is systematically equipped to poll for new commands every 15 seconds, transmit regular heartbeat messages, supply a comprehensive list of installed applications, and siphon sensitive data from iCloud Keychains alongside personal information stored within Apple Notes, Photos, and various cryptocurrency wallet applications. The server responses to these periodic polling tasks contain explicit commands instructing the victim’s phone to execute specific malicious routines.
Intriguingly, security monitoring has revealed that the same P7 DarkSword exploit infrastructure has been distributed via a compromised domain originally associated with a now-defunct Czech e-commerce analytics startup. According to telemetry from Report URI, unknown threat actors re-registered the domain "ecomtrack.io" following its expiration in mid-September 2026. This allowed them to weaponize websites that still contained legacy tracking tags referencing the abandoned analytics product, injecting malicious JavaScript designed to deliver the mobile malware to unsuspecting visitors.
Security researcher Scott Helme noted that with the tracking tag still sitting dormant on numerous online stores, the compromised domain now actively hijacks incoming visitors, monetizes them through external ad networks, and, in specific high-value cases, delivers a full iOS exploit chain and sophisticated spyware implant. The newly deployed JavaScript incorporates robust evasive measures designed to actively detect web crawlers, headless testing browsers, and automated bots, utilizing advanced cloaking tactics to feed them empty content and obscure its malicious intent. It simultaneously gathers extensive metadata regarding the host device and browser environment, transmitting these details to an external server before redirecting the visitor toward scam websites or fraudulent online casinos.
One prominent delivery route leads users to a bogus cryptocurrency trading platform operating under the domain "chainmate.top," which stealthily serves the DarkSword iOS exploit chain. The resulting implant is specifically configured to harvest a vast array of sensitive personal data, including SMS messages, contact lists, call histories, voicemails, photographs, Apple Health metrics, location history, system notifications, saved Wi-Fi network passwords, and local files belonging to more than 25 distinct cryptocurrency wallet applications.
Additional analysis of recovered code samples indicates that the malicious build communicates with a command server at "mertio.cc" every 30 seconds, executing core functional commands categorized as execution, file downloading, photo harvesting, and active espionage. Security analysts noted that the specific build recovered appears to be a newer version (v24), which reports to alternative infrastructure and targets a significantly expanded array of digital asset wallets.
This wave of disclosures coincides with findings from Censys, which identified open directories hosted on multiple servers carrying components directly related to both DarkSword and Coruna. Coruna functions as a companion payload kit distributed within the same overarching cybercriminal ecosystem, with its operational stages executing directly inside the victim’s browser session immediately after the initial DarkSword exploit stages land on the device. Its dedicated wallet-harvesting modules are designed to steal cryptocurrency recovery phrases, account balances, and keystore data from native iOS applications, with operators routinely deploying DarkSword and Coruna in tandem against unified C2 infrastructure.
An exhaustive security analysis of the production server’s internal exploit registry revealed that the DarkSword exploit kit incorporates multiple vulnerabilities, including CVE identifiers that had not been previously documented in public threat intelligence feeds. Security researchers strongly suspect that the open-directory cluster and associated exploitation platforms are operated by a Chinese-speaking threat actor group primarily focused on large-scale cryptocurrency wallet theft, though the exact identities of the masterminds remain officially unconfirmed.
According to Censys researcher Aidan Holland, the underlying platform effectively operates as a Chinese-speaking exploitation-as-a-service enterprise. The administrative control panel exposes a structured agent and reseller model, while recovered copies of the production server have contained numerous victim recovery phrases, extensive device loot directories, and an active control-plane roster comprising dozens of compromised accounts.
Furthermore, Censys researchers detected a separate China-based operator actively running the identical exploit kit in the wild against its own dedicated C2 server infrastructure hosted at "66ds.lol," while incorporating additional cryptocurrency wallet targets that were absent from previous open-directory datasets. These collective findings underscore the widespread commercial proliferation and accessibility of sophisticated mobile exploit frameworks among financially motivated cybercriminals operating globally.
