Cybersecurity researchers have uncovered details of a previously unseen and highly evolved variant of the DarkSword iOS exploit kit, designated as P7 DarkSword. The discovery highlights the continuous adaptation and commercialization of sophisticated mobile surveillance and credential-theft toolkits circulating among financially motivated threat actors and commercial vendors alike.
According to a comprehensive threat research report published by mobile security firm iVerify, the newly identified P7 variant introduces several distinct technical modifications compared to earlier iterations. Most notably, the variant reduces its operational footprint on compromised devices, incorporates native on-device keychain and cryptocurrency wallet theft capabilities, and establishes robust two-way command-and-control communication with the attacker’s underlying infrastructure.
Researchers explained that the designation "P7" serves as a direct reference to the threat actor’s distinct naming convention, specifically their use of the "p7_" variable prefix embedded within modifications made to the original DarkSword source code.
The baseline DarkSword framework was first publicly documented earlier this March by the Google Threat Intelligence Group (GTIG), alongside iVerify and Lookout. Initial disclosures detailed the kit’s capacity to target Apple iPhones running iOS versions ranging between iOS 18.4 and iOS 18.7, following its initial detection in the wild in November 2025.
Engineered as a multi-stage attack chain, the toolkit leverages a combination of vulnerabilities designed to systematically break out of the mobile browser sandbox, achieve kernel-level privilege escalation, and inject its primary payload directly into SpringBoard—the core iOS system process responsible for managing application launches, the user interface, and the home screen environment. Security analysts have long assessed the exploit chain to be a commercial-grade product that somehow leaked into the secondary market, where it was subsequently acquired by financially motivated groups and state-aligned actors starting in late 2025.
Since its initial proliferation, the DarkSword exploit kit has been deployed in targeted campaigns across various global regions, including Saudi Arabia, Turkey, Malaysia, and Ukraine. Multiple threat groups have utilized the tool, such as PARS Defense, a Turkish commercial surveillance vendor that distributed the exploit via a deceptive, Snapchat-themed website, and Star Blizzard, a Russia-aligned threat actor also known as COLDRIVER, which relied on social engineering lures disguised as professional invitations. Furthermore, in August 2026, attack surface management platform Censys detailed a separate operation executed by an unknown Chinese-speaking threat actor that leveraged the exploit kit alongside an Apple ID decoy authentication page.
As recently as last month, iVerify reported observing multiple unsuccessful, likely large language model (LLM)-assisted attempts by various actors to update the framework to support newer iOS 26.x iterations, driven by the broader leak of the exploit kit’s source code shortly after its initial public disclosure. These improvised variants have largely focused on maximizing operational stability, maintaining stealth, and improving the volume and quality of exfiltrated data. iVerify has also noted instances where DarkSword and Coruna—another prominent iOS exploit kit discovered this year—were bundled together in operations dubbed DarkCoruna, indicating shared infrastructure and collaborative tool-sharing within certain threat ecosystems.
The P7 DarkSword variant represents a significant technological leap forward in these operational aspects. By eliminating conventional debug logging over HTTP requests and system logs (syslog), and by leveraging browser localStorage mechanisms to prevent redundant re-exploitation attempts, the variant minimizes its forensic artifacts. Furthermore, unlike predecessor variants that copied and exfiltrated raw keychain databases for external processing on attacker-controlled servers, P7 DarkSword parses and extracts targeted keychain data directly into structured JSON formats locally on the victim’s device prior to exfiltration.
The implant, once successfully injected into the SpringBoard process, takes charge of all direct communications with the external infrastructure. The latest iteration is configured to poll for incoming operational commands at regular 15-second intervals. During these check-ins, it transmits a persistent heartbeat message, compiles and sends a comprehensive inventory of installed applications, and forwards sensitive data extracted from the iCloud Keychain, Apple Notes, Apple Photos, and more than two dozen distinct cryptocurrency wallet applications. The responses returned during these periodic tasking polls deliver executable commands directly to the compromised device, dictating subsequent attacker actions.
In a parallel development illustrating the diverse delivery mechanisms associated with these threats, the P7 DarkSword exploit chain has also been observed propagating through compromised domains originally managed by defunct commercial entities. Security researcher Scott Helme of Report URI highlighted an incident where unknown threat actors re-registered an expired domain, "ecomtrack[.]io," which had previously belonged to a Czech e-commerce analytics startup. Because numerous online retail platforms still embedded legacy tracking scripts referencing the defunct analytics service, the re-registered domain began hijacking incoming web traffic.
The injected JavaScript utilizes sophisticated evasion heuristics designed to detect and bypass automated web crawlers, headless browsers, and security bots by serving empty cloaked content. It simultaneously harvests contextual data regarding the visitor’s device and browser environment, transmitting these metrics to an external server before redirecting unsuspecting users toward malicious scam portals or fraudulent online gambling platforms.
One specific redirection pathway leads victims to a bogus cryptocurrency trading platform named "chainmate[.]top," which covertly serves the DarkSword iOS exploit chain. The resulting implant is engineered to capture an extensive array of personal and sensitive data, including SMS messages, contact lists, call histories, voicemails, photos, Apple Health records, location histories, system notifications, saved Wi-Fi network credentials, and application files associated with over 25 different cryptocurrency wallet utilities. According to findings from Report URI, the retrieved code communicates with external infrastructure at "mertio.cc" every 30 seconds, executing advanced operational commands categorized as execution, download, photo harvesting, and active espionage, representing a newer, more aggressive build of the malware ecosystem.
Concurrently, Censys reported the identification of open directories hosted across multiple servers containing operational components related to both DarkSword and Coruna. According to Censys, Coruna functions as a companion payload framework within the same threat ecosystem, executing secondary stages inside the victim’s active browser session after the initial DarkSword exploit stages have successfully landed. Its specialized modules target cryptocurrency recovery phrases, account balances, and keystore data directly from mobile applications, operating in tandem with DarkSword against centralized command-and-control infrastructure.
An exhaustive technical analysis of the production server’s exploit registry has further revealed that the DarkSword exploit kit integrates two previously undocumented CVE identifiers. While precise attribution remains complex due to the decentralized and commercialized nature of the tooling, security researchers suspect that a portion of the open-directory infrastructure and specific exploitation platforms are operated by Chinese-speaking actors primarily focused on large-scale cryptocurrency theft.
Researchers analyzing the exposed administration panels noted evidence of an agent and reseller operational model, pointing to a structured exploitation-as-service enterprise. Recovered copies of production servers have revealed multiple victim recovery phrases, extensive device loot directories, and detailed control-plane rosters. Additional detections by Censys involving China-based operators utilizing distinct hosting providers and unique self-signed certificate authorities further underscore the widespread distribution, commercial availability, and persistent danger posed by these sophisticated iOS exploit kits across the global threat landscape.
