New P7 DarkSword iOS Exploit Variant Emerges with Reduced Footprint and Advanced Crypto-Theft Capabilities

Cybersecurity researchers have uncovered details regarding a previously undocumented and highly sophisticated variant of the DarkSword iOS exploit kit, designated by analysts as P7 DarkSword. This new iteration introduces critical modifications designed to increase stealth, reduce on-device footprints, and expand malicious capabilities to include direct keychain extraction and cryptocurrency wallet theft.

According to a comprehensive threat research report published by mobile security firm iVerify, the "P7" designation stems from the threat actor’s specific use of the "p7_" variable prefix during alterations made to the source code of the original DarkSword framework. Compared to prior iterations observed by security teams, this variant represents a significant evolution in how commercial-grade mobile exploit kits are being adapted for persistent, financially motivated cybercrime.

The original DarkSword framework was first documented publicly in March by the Google Threat Intelligence Group (GTIG), alongside iVerify and Lookout. That initial disclosure detailed the toolkit’s capacity to target iPhones running iOS versions ranging between iOS 18.4 and iOS 18.7, following its initial detection in the wild in November 2025.

Engineered as a multi-stage attack chain, the toolkit chains several distinct iOS vulnerabilities to successfully escape the tight confines of the Safari browser sandbox, escalate privileges to the kernel level, and finally inject its primary payload into SpringBoard—the core iOS process responsible for managing application launches and the device’s home screen interface. Security analysts have long assessed the exploit chain to be a commercial surveillance product that somehow leaked onto the secondary market, where it was subsequently acquired and deployed by financially motivated cybercriminals and other threat actors starting in late 2025.

Since its initial proliferation, the DarkSword exploit kit has been utilized in targeted campaigns across multiple regions, including Saudi Arabia, Turkey, Malaysia, and Ukraine. Notable operators have included a Turkish commercial surveillance vendor known as PARS Defense, which deployed the kit via a fake, themed Snapchat website, as well as a Russia-aligned threat actor tracked as Star Blizzard (also recognized as COLDRIVER), which utilized fraudulent invitation lures. Furthermore, in August 2026, attack surface management platform Censys detailed a separate campaign mounted by an unknown Chinese-speaking threat actor that leveraged the exploit kit alongside deceptive Apple ID sign-in pages.

The public disclosure and subsequent leak of the DarkSword source code have spurred a wave of secondary development. Last month, iVerify reported observing multiple unsuccessful, likely LLM-assisted attempts by various actors to update the framework to support newer operating system versions, specifically iOS 26.x. These experimental variants have primarily focused on improving operational stability, enhancing evasion techniques, and maximizing the volume and quality of stolen data.

In some rare instances, security researchers have even observed DarkSword bundled alongside Coruna, another prominent iOS exploit kit discovered earlier this year that weaponizes vulnerabilities affecting iPhone models running iOS versions 13.0 through 17.2.1. Security teams refer to this combined deployment method as DarkCoruna. According to iVerify, threat actors likely obtained the source code for the Coruna exploit kit and independently modified it, noting a complete absence of binary patching and the presence of substantial code rewrites compiled directly into entirely new binaries.

While many of these bundled variants represent non-sophisticated or broken attempts by low-tier actors deploying patched versions sourced from GitHub repositories, security analysts emphasize that the threat landscape remains dynamic. The risk persists that actors unable to legitimately acquire underlying exploit frameworks may increasingly rely on artificial intelligence models to reverse-engineer and re-implement complex mobile exploits.

Against this backdrop of widespread proliferation and experimentation, P7 DarkSword stands out due to its technical sophistication and operational refinements. The new variant completely eliminates debug logging over standard HTTP requests and system logs (syslog), relying instead on the browser’s local storage mechanisms to prevent redundant re-exploitation attempts on targeted devices.

Furthermore, unlike older iterations that merely copied and exfiltrated raw keychain databases for external processing on attacker-controlled infrastructure, P7 DarkSword intelligently extracts keychain data directly into structured JSON formats locally on the victim’s phone prior to exfiltration. Once the implant successfully injects itself into the SpringBoard process, it establishes resilient, two-way Command and Control (C2) communication with the attacker’s infrastructure.

The implant is engineered to poll for new instructions every 15 seconds, continuously transmitting a heartbeat message, a comprehensive list of installed applications, sensitive iCloud Keychain information, and internal data pulled from prominent productivity and financial applications, including Apple Notes, Photos, and diverse cryptocurrency wallets. The responses received from these periodic polling tasks deliver immediate commands for execution on the compromised device.

Simultaneously, threat intelligence platforms have tracked how these exploit kits are being distributed through unconventional delivery vectors, including abandoned web infrastructure. Recent telemetry from Report URI revealed that unknown threat actors re-registered an expired domain previously utilized by a defunct Czech e-commerce analytics startup, known as "ecomtrack.io," on September 15, 2026. Because numerous online retail platforms still maintained legacy tracking tags referencing the defunct analytics product, the domain hijacking allowed malicious JavaScript to be injected directly into unsuspecting e-commerce sites.

Security researcher Scott Helme noted that the malicious JavaScript actively intercepts site visitors, filtering out web crawlers, headless browsers, and automated bots through sophisticated cloaking tactics designed to serve empty content and conceal its underlying operations. After harvesting basic device and browser telemetry, the script redirects the user toward scam platforms or fraudulent online gaming portals.

One primary redirection route leads visitors to a bogus cryptocurrency trading platform operating under the domain "chainmate.top," which stealthily delivers the DarkSword iOS exploit chain. The resulting spyware implant is exceptionally thorough, configured to capture a sweeping range of personal and sensitive information, including SMS messages, contact lists, call histories, voicemails, photos, Apple Health metrics, location histories, system notifications, saved Wi-Fi credentials, and files belonging to more than 25 distinct cryptocurrency wallet applications.

Code recovery efforts surrounding this campaign indicate that the deployed builds are actively communicating with external infrastructure hosted at "mertio.cc" at 30-second intervals. These builds execute advanced modular commands encompassing remote execution, file downloads, photo harvesting, and deep espionage routines, targeting an even broader array of decentralized asset storage mechanisms.

Concurrently, Censys reported the identification of open directories across five distinct hosts carrying operational components associated with both DarkSword and Coruna. Security analysts explained that Coruna serves as a companion payload kit operating within the same threat ecosystem, with its individual stages executing inside the victim’s active browser session immediately after the initial DarkSword exploit stages successfully land. The wallet-harvesting modules integrated within Coruna are specifically designed to steal recovery phrases, cryptocurrency balances, and keystore data directly from mobile applications, with operators coordinating DarkSword and Coruna campaigns against unified C2 infrastructure.

Deep technical analysis of the production server’s exploit registry associated with these campaigns has further revealed that the DarkSword exploit kit integrates multiple CVE identifiers that had not been previously documented in public vulnerability databases. Industry analysts strongly suspect that this open-directory cluster, alongside a primary exploitation platform hosted at IP address 156.239.230.120, is operated by a Chinese-speaking threat actor focused primarily on large-scale cryptocurrency theft.

According to Censys researcher Aidan Holland, the platform operates as a structured exploitation-as-a-service model. The underlying administrator panel exposes an integrated agent and reseller framework, and forensic recovery of a production server instance uncovered sensitive operational data, including 11 distinct victim recovery phrases, 179 separate device loot directories, and a control-plane roster comprising 75 active accounts.

Additionally, Censys security teams detected a separate, China-based operator executing identical exploit kits in the wild against a dedicated C2 server domain registered as "66ds.lol." This specific infrastructure introduced support for targeting additional cryptocurrency storage applications, such as BitKeep, which were absent from the previously identified open-directory set. This activity is tied to Tencent and Shenyang hosting providers and linked to the threat operator through a unique, self-signed certificate authority, further demonstrating the extensive commercialization and widespread adoption of advanced mobile exploit kits among financially motivated criminal networks.