New Variant of DarkSword iOS Exploit Kit Surfaces with Advanced Crypto-Theft Capabilities

Cybersecurity researchers have uncovered a previously unseen and highly sophisticated variant of the DarkSword iOS exploit kit, designated by analysts as P7 DarkSword. The newly identified iteration marks a significant technical evolution in how commercial-grade mobile exploitation tools are being modified, repurposed, and deployed by various threat actors in the wild.

According to a comprehensive threat research report published by mobile security firm iVerify, the P7 variant introduces several notable modifications compared to the baseline frameworks historically observed by defenders. Most prominently, the P7 variant dramatically reduces its on-device operational footprint, implements direct on-chain keychain and cryptocurrency wallet theft capabilities, and establishes robust, two-way command-and-control (C2) communication directly with the attacker’s server infrastructure.

The designation "P7" originates from a specific signature left by the threat actor within the codebase itself. Researchers noted that the moniker is a direct nod to the extensive use of the "p7_" variable prefix throughout the modifications applied to the original DarkSword source code.

The baseline DarkSword framework was first brought to public attention in March of this year through coordinated disclosures by the Google Threat Intelligence Group (GTIG), iVerify, and Lookout. Initial documentation revealed that the exploit kit possessed the alarming capability to target iPhones running iOS versions ranging from iOS 18.4 up to iOS 18.7. Forensic analysis indicated that the toolkit had been active in the wild since at least November 2025.

Engineered with advanced capabilities, the original DarkSword toolkit operates by chaining multiple zero-day or known iOS vulnerabilities together. This sophisticated chain allows the exploit to successfully break out of the restrictive browser sandbox, escalate privileges all the way to the kernel level, and finally inject its primary payload directly into SpringBoard, the core iOS system process responsible for managing application launches and rendering the user home screen. Security experts have long assessed this exploit chain to be a commercial surveillance product that somehow leaked into the secondary market, where it was subsequently acquired by financially motivated cybercriminals and nation-state-aligned operators starting in late 2025.

Since its initial leak and public disclosure, the exploit kit has been leveraged in targeted campaigns across multiple global jurisdictions, including Saudi Arabia, Turkey, Malaysia, and Ukraine. Various distinct threat groups have adopted the tooling. For instance, a Turkish commercial surveillance vendor known as PARS Defense was observed deploying DarkSword via a deceptive, fake Snapchat-themed website. Concurrently, a Russia-aligned threat actor tracked as Star Blizzard, also known as COLDRIVER, utilized custom fake invitation lures to direct victims toward the exploitation infrastructure.

The proliferation of the kit continued to widen later in the year. In August, attack surface management platform Censys detailed an active campaign mounted by an unknown Chinese-speaking threat actor. This operation targeted Apple iOS devices with the exploit kit while simultaneously serving fraudulent Apple ID decoy sign-in pages to harvest user credentials.

The threat landscape surrounding the toolkit grew even more chaotic following its public exposure, which inadvertently triggered a wave of copycat activity. Last month, iVerify reported observing multiple unsuccessful, likely large language model-assisted attempts by low-sophistication actors to update the framework to support newer operating system versions, specifically iOS 26.x. These unauthorized variants were largely focused on improving operational stability, enhancing stealth mechanisms, and refining the quality of data exfiltration.

Furthermore, security researchers have noted instances where DarkSword and another prominent mobile exploit kit known as Coruna were bundled together into a hybrid deployment referred to by analysts as DarkCoruna. Investigators determined that attackers managed to obtain the source code for the Coruna exploit kit and manually modify it. Rather than relying on simple binary patching, these actors performed extensive code overhauls, compiling entirely new binaries. While many of these bundled variants observed on public code repositories like GitHub amounted to non-working code—often characterized by researchers as "AI slop" deployed by amateur attackers—experts warn that the capability of malicious actors to reverse-engineer and re-implement complex exploit frameworks with the assistance of artificial intelligence remains a pressing concern.

The newly detailed P7 DarkSword variant represents a much more competent evolution of these trends. It systematically eliminates debug logging over standard HTTP requests and syslog, relying instead on browser localStorage mechanisms to prevent redundant re-exploitation attempts on already compromised devices. Furthermore, while prior iterations of the exploit kit copied and exfiltrated raw keychain databases back to the attacker’s infrastructure for offline processing, the P7 version streamlines this process. It extracts and parses sensitive keychain data directly into structured JSON format locally on the victim’s phone before initiating exfiltration.

Operating from within the compromised SpringBoard process, the P7 implant maintains constant communication with the adversary’s server ecosystem. The malware is engineered to poll for new commands every 15 seconds, dispatching regular heartbeat messages, transmitting complete inventories of installed applications, and exfiltrating sensitive iCloud Keychain information alongside personal data extracted from core Apple applications such as Notes, Photos, and various cryptocurrency wallet applications. The server responses to these periodic polls contain precise tasking instructions that are executed directly on the victim’s device.

Intriguingly, recent investigations have revealed novel distribution vectors for the P7 DarkSword exploit chain. Security researcher Scott Helme, writing via Report URI, disclosed that the same exploit variant has been actively distributed through a web domain previously associated with a now-defunct Czech e-commerce analytics startup. According to telemetry data, unknown threat actors re-registered the expired domain, "ecomtrack.io," on September 15, following its lapse. The operators utilized the domain to target online stores that still featured active tracking scripts referencing the former analytics product. By injecting malicious JavaScript into these legacy tracking tags, the threat actors successfully hijacked incoming store visitors.

The malicious script incorporates advanced evasive maneuvers designed to detect automated web crawlers, headless browsers, and security research bots, utilizing aggressive cloaking tactics to feed them benign or empty content to avoid detection. Once a genuine human visitor is identified, the script gathers detailed browser and device telemetry, transmits the information to an external server, and subsequently redirects the user to fraudulent websites or online casinos.

One primary redirection route leads unsuspecting victims to a bogus cryptocurrency trading platform operating under the domain "chainmate.top," which stealthily delivers the full DarkSword iOS exploit chain. The resulting spyware implant is exceptionally comprehensive, capable of capturing SMS messages, contacts, call history, voicemails, photos, Apple Health data, location histories, system notifications, saved Wi-Fi network passwords, and data files belonging to more than 25 distinct cryptocurrency wallet applications.

Additional findings published by Censys revealed the discovery of open directories on multiple internet-facing hosts containing components related to both DarkSword and Coruna. Coruna acts as a companion payload kit within the same threat ecosystem, with its operational stages executing directly inside the victim’s browser session immediately after the initial DarkSword exploit stages succeed. Its dedicated wallet-harvesting modules are specifically designed to steal cryptocurrency recovery phrases, account balances, and keystore data directly from installed iOS applications.

An in-depth cryptographic and technical analysis of production servers linked to these campaigns revealed that the underlying DarkSword exploit registry incorporates previously undocumented Common Vulnerabilities and Exposures (CVE) identifiers. Security analysts suspect that these open-directory clusters and associated infrastructure platforms are operated by Chinese-speaking threat actors primarily focused on large-scale financial theft.

Censys researchers noted that the infrastructure operates under an exploitation-as-a-service model. Administrative panels recovered during investigations exposed an active agent and reseller framework, alongside production server backups containing dozens of victim recovery phrases, hundreds of device loot directories, and an extensive control-plane account roster. Additional infrastructure tracking identified separate China-based operators running identical tooling against custom command-and-control servers, expanding their targeting parameters to include newer cryptocurrency storage solutions such as BitKeep.

These mounting discoveries underscore the ongoing commercialization, leaking, and proliferation of advanced mobile exploitation kits among financially motivated cybercriminal networks, presenting persistent challenges for defenders and device manufacturers alike.