Cybersecurity researchers have uncovered details of a previously unseen and highly sophisticated variant of the DarkSword iOS exploit kit, designated as P7 DarkSword. According to a new threat research report published by mobile security firm iVerify, this latest iteration introduces significant modifications compared to earlier versions observed in the wild. Notably, the P7 variant reduces its on-device operational footprint, integrates direct on-device keychain and cryptocurrency wallet theft, and establishes a robust two-way command-and-control (C2) communication channel with the attacker’s underlying infrastructure.
The nomenclature "P7" serves as a direct nod to the threat actor’s methodology, specifically referencing the use of the "p7_" variable prefix identified within modifications made to the original DarkSword source code. The emergence of this variant underscores the ongoing evolution of mobile exploitation frameworks, which continue to be adapted and refined by various cybercriminal and state-sponsored syndicates.
The original DarkSword toolkit was first publicly documented earlier in March by the Google Threat Intelligence Group, alongside iVerify and Lookout. Initial disclosures detailed the kit’s formidable capability to systematically target iPhones running iOS versions ranging from iOS 18.4 through 18.7. Telemetry data indicated that the toolkit had been actively detected in the wild as early as November 2025.
Engineered as a multi-stage weapon, the toolkit relies on chaining multiple underlying iOS vulnerabilities to successfully escape the strict confines of the Safari browser sandbox. From there, it escalates privileges to the kernel level before injecting its primary payload directly into SpringBoard—the core iOS process responsible for managing application launches, user interactions, and the home screen interface. Security analysts have assessed that the exploit chain originated as a commercial surveillance product. Through mechanisms that remain partially obscured, the framework eventually leaked into the secondary market, where it was rapidly acquired by financially motivated operators and other malicious actors starting in late 2025.
Since its broader proliferation, the DarkSword exploit kit has been leveraged in targeted campaigns across several geographic regions, including Saudi Arabia, Turkey, Malaysia, and Ukraine. Multiple distinct threat groups have adopted the tooling. Among them is a Turkish commercial surveillance vendor known as PARS Defense, which deployed the kit via fake Snapchat-themed landing pages, as well as a Russia-aligned threat group tracked as Star Blizzard, also known as COLDRIVER, which utilized deceptive invitation lures to snare victims.
The threat landscape surrounding the toolkit expanded further in August 2026, when attack surface management platform Censys detailed a separate campaign orchestrated by an unknown Chinese-speaking threat actor. This campaign targeted Apple iOS devices using the exploit kit while simultaneously serving fraudulent Apple ID decoy sign-in pages to harvest user credentials.
As recently as last month, iVerify reported observing multiple unsuccessful, likely large language model-assisted attempts by various actors to update the framework to maintain compatibility with newer iOS 26.x iterations. These efforts were largely fueled by the broader leak of the exploit toolkit shortly after its initial public disclosure. Mobile security experts noted that these amateur variants were primarily focused on improving execution stability, enhancing stealth, and optimizing the quality of data exfiltrated from compromised devices.
In addition to standalone deployments, iVerify revealed that it had occasionally observed DarkSword and another prominent mobile exploit kit, known as Coruna, bundled together in rare joint operations, a combination referred to by researchers as DarkCoruna. Analysts believe that these attackers acquired the source code for the Coruna exploit kit and independently modified it, noting that the binaries showed no evidence of simple patching but rather significant, compiled code rewrites. While many of the bundled variants observed by researchers consist of broken, non-working attempts deployed by less sophisticated actors utilizing code scraped from GitHub, security firms warn that the barrier to entry for mobile exploitation is lowering due to the potential application of automated tools and reverse-engineering assistance.
P7 DarkSword represents a distinct technical advancement by addressing several operational hurdles faced by earlier iterations. The new variant completely eliminates debug logging over HTTP requests and system logs, utilizing the browser’s localStorage mechanism to prevent redundant re-exploitation attempts on the same device. Furthermore, unlike prior versions that copied and exfiltrated the entire raw keychain database to be processed offline on external servers, P7 DarkSword extracts and parses keychain data directly into structured JSON formats locally on the victim’s phone prior to exfiltration.
The injected implant inside the SpringBoard process acts as the central hub for managing all communications with the attacker’s backend infrastructure. According to iVerify’s analysis, the latest iteration is equipped to poll for new commands every 15 seconds, transmitting a routine "heartbeat" message alongside a comprehensive list of installed applications. It is also engineered to transmit sensitive iCloud Keychain information and harvested data from popular applications, including Apple Notes, Photos, and a wide array of cryptocurrency wallet software.
The response payload returned during these periodic tasking polls delivers specific commands to be executed directly on the victim’s mobile device, allowing operators to dynamically control the compromised environment.
Intriguingly, forensic investigations have revealed that the P7 DarkSword exploit chain has also been distributed via infrastructure associated with a now-defunct Czech e-commerce analytics startup. According to telemetry from Report URI, unknown threat actors successfully re-registered the domain "ecomtrack.io" on September 15, 2026, shortly after its registration expired. The perpetrators utilized the abandoned domain to target online stores that still incorporated legacy tracking tags referencing the defunct analytics product. By injecting malicious JavaScript into these sites, the attackers hijacked unsuspecting visitors, redirected traffic to ad networks, and, in specific instances, delivered a full iOS exploit chain and mobile spyware implant.
Security researcher Scott Helme noted that the newly deployed JavaScript incorporates sophisticated evasive maneuvers designed to detect automated web crawlers, headless browsers, and security bots. By employing advanced cloaking tactics, the script feeds empty content to verification tools to mask its malicious activities. Simultaneously, it collects granular information about the visitor’s device and browser environment, transmitting these details to an external server before redirecting the user to unrelated scam sites or fraudulent online gambling portals.
One primary delivery route directs victims to a bogus cryptocurrency trading platform operating under the domain "chainmate.top," which stealthily serves the DarkSword iOS exploit chain. The resulting implant is exceptionally comprehensive, engineered to capture a massive array of personal data, including SMS messages, contact lists, call histories, voicemails, photos, Apple Health records, precise location histories, system notifications, saved Wi-Fi network passwords, and local files belonging to more than 25 distinct cryptocurrency wallet applications.
Further analysis of a newer build recovered from these operations, version 24, revealed that it communicates with a separate command-and-control server at "mertio.cc" every 30 seconds, supporting versatile functional commands such as file execution, data downloading, photo extraction, and general espionage operations.
This wave of disclosures coincides with findings from Censys, which identified open directories on five separate hosting servers carrying components directly related to both DarkSword and Coruna. Coruna has been tracked throughout the year as a companion payload kit weaponized against older iPhone models running iOS versions between 13.0 and 17.2.1. Security researchers explained that Coruna’s operational stages execute directly within the victim’s active browser session after the initial DarkSword exploit stages have successfully landed, deploying specialized wallet-harvesting modules designed to steal cryptocurrency recovery phrases, account balances, and keystore data from mobile applications.
An examination of production server exploit registries associated with these campaigns has further revealed that the DarkSword exploit kit incorporates previously undocumented Common Vulnerabilities and Exposures (CVE) identifiers. Authorities and researchers suspect that the open-directory cluster and an associated exploitation platform hosted at IP address 156.239.230.120 are operated by a Chinese-speaking threat actor primarily focused on large-scale cryptocurrency theft.
Censys researcher Aidan Holland noted that the discovered platform operates as an active exploitation-as-a-service model. The underlying administrative panel exposes a structured agent and reseller framework, with a recovered copy of the production server containing empirical evidence of past compromises, including 11 victim recovery phrases, 179 distinct device loot directories, and a control-plane roster tracking 75 active accounts.
Additionally, Censys detected a separate, China-based operator running identical tooling against its own dedicated command-and-control infrastructure hosted at "66ds.lol," which notably included targeting additional cryptocurrency platforms like BitKeep that were absent from the open-directory server sets. These findings collectively emphasize the growing commercialization, proliferation, and broad adoption of advanced mobile exploitation kits among financially motivated cybercriminal networks operating globally.
