New Variant of DarkSword iOS Exploit Kit Emerges with Advanced Keychain and Crypto-Wallet Theft Capabilities

Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword, highlighting a worrying evolution in mobile attack tooling that combines lower device footprints with aggressive data harvesting.

Compared with the variants usually observed by security analysts, the newly identified P7 iteration reduces its on-device footprint while introducing direct on-device keychain and crypto-wallet theft, alongside two-way command-and-control (C2) communication with the attacker’s infrastructure. Mobile security firm iVerify detailed these findings in a threat research report, noting that the name "P7" serves as a direct nod to the threat actor’s use of the "p7_" variable prefix in modifications made to the original DarkSword source code.

The broader DarkSword framework was first publicly documented earlier in March by the Google Threat Intelligence Group (GTIG), iVerify, and Lookout. Initial disclosures detailed its capability to target iPhones running iOS versions between iOS 18.4 and 18.7, after the kit was detected actively operating in the wild in November 2025.

The toolkit is meticulously engineered to chain multiple iOS vulnerabilities together, allowing malicious actors to successfully escape the browser sandbox, escalate privileges to the kernel, and inject the primary payload directly into SpringBoard—the core iOS process responsible for managing application launches and the user home screen. Security assessments indicate that the exploit chain originated as a commercial product that somehow leaked onto the second-hand market. From there, it was rapidly acquired by financially motivated operators and various other threat actors starting in late 2025.

Since its public introduction, the exploit kit has been deployed in targeted campaigns across Saudi Arabia, Turkey, Malaysia, and Ukraine by an assortment of threat actors. Notable operators include a Turkish commercial surveillance vendor known as PARS Defense, which utilized a fake Snapchat-themed website to distribute the payload, and a Russia-aligned threat actor designated as Star Blizzard—also known as COLDRIVER—which relied on deceptive invitation lures.

Further compounding the threat landscape, attack surface management platform Censys detailed a campaign in August mounted by an unknown Chinese-speaking threat actor. This operation targeted Apple iOS devices using the exploit kit alongside a convincing Apple ID decoy sign-in page designed to harvest user credentials.

As recently as last month, iVerify reported observing multiple unsuccessful, likely large language model (LLM)-assisted attempts by various threat actors to update the framework to support newer iOS 26.x releases. These attempts were catalyzed by the widespread leak of the exploit kit shortly after its initial public disclosure. Mobile security experts noted that these amateur variants were primarily focused on improving stability, stealth, and the overall quality of stolen data.

In rare instances, iVerify has also observed DarkSword and another related toolkit, Coruna, bundled together in combined deployments referred to as DarkCoruna. Investigators believe these attackers obtained the source code for the Coruna exploit kit and modified it directly. Analyses revealed no signs of binary patching; instead, substantial code changes were executed and compiled directly into entirely new binaries.

While many bundled variants encountered by researchers appear to be non-working attempts generated through automated AI tools—with unsophisticated actors deploying broken iterations of patched Coruna and DarkSword obtained from GitHub—security teams cannot rule out the possibility that attackers unable to secure the original Coruna source code might eventually reverse-engineer and re-implement it using advanced language models, though concrete evidence of this remains scarce.

The newly detailed P7 DarkSword variant represents a significant technical evolution by eliminating debug logging over HTTP requests and syslog, while leveraging browser localStorage to prevent repeated re-exploitation attempts. Unlike older variants that copied and exfiltrated the raw keychain database to be processed externally on the attacker’s infrastructure, this advanced version extracts keychain data directly into structured JSON format right on the infected phone prior to exfiltration.

The implant is injected directly into the SpringBoard process, which subsequently handles all communication with the attacker’s command-and-control infrastructure. This latest iteration is fully equipped to poll for new commands every 15 seconds, transmit regular heartbeat messages, report a complete list of installed applications, and siphon off sensitive iCloud Keychain information along with valuable data from applications such as Apple Notes, Photos, and various cryptocurrency wallets.

The response payloads returned during these periodic tasking polls contain specific instructions to be executed directly on the victim’s mobile device, reflecting a high degree of interactive control by the operators.

Intriguingly, security monitoring has revealed that the same P7 DarkSword exploit mechanism has been distributed through a domain previously associated with a now-defunct Czech e-commerce analytics startup. According to insights from Report URI, unknown threat actors successfully re-registered the domain "ecomtrack.io" following its expiration, targeting online stores that still incorporated outdated tracking tags referencing the former analytics product. By injecting malicious JavaScript into these tags, the operators began hijacking unsuspecting site visitors, redirecting them to advertising networks, and in specific cases, delivering a full iOS exploit chain and spyware implant.

Security researcher Scott Helme noted that the newly deployed JavaScript incorporates sophisticated evasive measures designed to detect automated web crawlers, headless browsers, and bots, utilizing cloaking tactics to feed them empty content and conceal its malicious nature. The script also gathers comprehensive diagnostic information about the visitor’s device and browser, transmitting these details to an external server before redirecting the user toward various scam sites or fraudulent online casinos.

One primary distribution route leads victims to a bogus cryptocurrency trading platform named "chainmate.top," which stealthily serves the DarkSword iOS exploit chain. The resulting implant is specifically configured to capture an expansive range of sensitive data, including SMS messages, contact lists, call histories, voicemails, photos, Apple Health data, location histories, device notifications, saved Wi-Fi passwords, and critical files belonging to more than 25 different cryptocurrency wallet applications.

The recovered code has been observed contacting "mertio.cc" every 30 seconds to handle operational commands including execution directives, file downloads, photo gathering, and general espionage functions. Analysts indicated that the specific build recovered appears to be a newer version, operating on distinct infrastructure and targeting a significantly broader array of digital wallets.

This ongoing disclosure coincides with findings from Censys, which identified open directories hosted on five separate servers carrying components closely tied to DarkSword and Coruna. Coruna represents a companion payload kit distributed within the same overarching ecosystem, engineered to target iPhone models running iOS versions ranging from 13.0 to 17.2.1.

According to Censys researchers, Coruna’s operational stages execute directly inside the victim’s active browser session after the initial DarkSword exploit stages successfully land on the device. Its specialized wallet-harvesting modules are designed to extract cryptocurrency recovery phrases, account balances, and keystore data directly from native iOS applications, with operators coordinating DarkSword and Coruna deployments simultaneously against a unified C2 infrastructure.

An in-depth forensic analysis of the production server’s exploit registry revealed that the DarkSword exploit kit utilizes two specific CVE identifiers that had not been previously documented in public threat intelligence databases. Investigators strongly suspect that this open-directory cluster and an associated platform hosted at 156.239.230.120 are operated by a Chinese-speaking threat actor whose primary objective is large-scale cryptocurrency wallet theft, though the precise identities behind the operation remain unconfirmed.

The underlying platform appears to operate an exploitation-as-a-service model, featuring an administrative control panel that exposes an agent and reseller structure. Forensic copies of the production server recovered by researchers contained data pointing to numerous victim recovery phrases, hundreds of device loot directories, and an extensive control-plane account roster.

Censys researchers also detected a separate China-based operator running the exact same exploit kit in the wild against a distinct command-and-control server at "66ds.lol," incorporating targeted support for additional cryptocurrency wallet applications not present in the open-directory set. These findings collectively underscore the widespread proliferation of sophisticated exploit kits among financially motivated cybercriminal networks operating across various global hosting providers.