P7 DarkSword: The iOS Exploit Kit Built to Steal Your Crypto Wallet and Remote-Control Your Phone

Researchers have detailed a DarkSword variant that injects an implant into SpringBoard, adds two-way command and control, and extracts keychain, wallet, photo, and notes data from devices exposed to the documented iOS exploit chains.

P7 DarkSword is a newly documented variant of the DarkSword iOS exploit kit, analyzed by iVerify after the broader kit was publicly described by Google Threat Intelligence Group, iVerify, and Lookout. DarkSword has targeted iPhones running iOS 18.4 through 18.7 and was detected in the wild as early as November 2025. P7 reduces logging, processes sensitive data on the phone, and adds a two-way command channel through an implant injected into SpringBoard.

How an iOS exploit kit actually works

iOS security rests heavily on sandboxing. Browser content runs inside restricted processes, so a useful drive-by chain must first gain code execution and then cross additional boundaries before it can reach privileged data or system processes.

DarkSword combines multiple vulnerabilities to escape the browser sandbox, reach kernel privileges, and inject its payload into SpringBoard. Later analysis of exposed operator infrastructure associated two additional flaws with the toolkit: CVE-2025-24201 in WebKit and CVE-2025-31200 in Core Audio. Public reporting does not establish that those two CVEs alone form the complete P7 chain.

"A sandboxed crash is a dead end for a malware writer. A SpringBoard implant turns the whole phone into a long-lived asset."

SpringBoard: control at the heart of the system

On a macOS machine, persistence means dropping a daemon. On iOS, the equivalent chokepoint is SpringBoard — the process behind the Home Screen, the app switcher, and the launch of every app. That makes it a prime injection target: it is privileged, it is always alive, and it is the layer where apps hand off to one another.

P7 DarkSword injects its payload into SpringBoard and uses it for a two-way command-and-control channel. According to iVerify’s analysis, the implant polls for commands about every fifteen seconds and can adjust that interval. This gives an operator repeated access while the implant is running; it should not be read as proof that the malware necessarily survives every reboot or system update.

What it steals, and why it's tuned for crypto

The data exfiltration is where P7 DarkSword's intent becomes clear. Rather than streaming everything home the moment it has access, the implant harvests on-device and processes the material locally before transmission. The targeted set: cryptocurrency wallets — including recovery phrases and balance data — iCloud Keychain contents, Photos, Apple Notes, the list of installed apps and account associations, and browser history. That combination is an escalation ladder for identity and financial theft. A wallet's recovery phrase alone can move every coin in it; the iCloud Keychain unlocks passwords and tokens for the victim's accounts; and personal data provides the social context that makes phishing convincing.

The wallet and keychain modules indicate a financial objective for at least some operators. Processing the keychain into JSON on the phone also changes what is transmitted, but it does not make the exfiltration invisible to network monitoring.

"The kit's focus on local processing before exfiltration is the signature of someone who has already thought about what happens when the victim's network is watched."

The threat actor — and what we still don't know

Researchers identified open directories on five hosts carrying components related to DarkSword and Coruna, a separate kit used against older iOS versions. Some infrastructure appears tied to a Chinese-speaking exploitation-as-a-service operation focused on cryptocurrency theft, but the operators behind every P7 deployment are not known. Earlier DarkSword activity has involved multiple actors, including financially motivated operators and surveillance campaigns, so shared tooling is not proof of a single sponsor.

The useful signal is proliferation: leaked or resold exploit-kit code can move between operators with different goals. Attribution should therefore stay separate from the technical finding that the same toolkit and payload family appears across multiple infrastructures.

What this means for you

Install the latest iOS release available for the device; the vulnerabilities publicly associated with the documented DarkSword chains have been patched. High-risk users should also consider Lockdown Mode. Battery drain or unusual traffic alone cannot confirm this compromise. If there is credible evidence of infection, preserve evidence where appropriate and seek qualified incident-response help before rotating credentials and moving wallet assets from a known-clean device.

How to check your exposure

Start with the version: an iPhone left on the affected iOS 18.4-to-18.7 range without later security updates was exposed to the documented chain. Network telemetry may reveal repeated beaconing, but ordinary users cannot reliably identify a sophisticated implant from battery or data usage. For a suspected targeted compromise, retain the device and relevant logs, contact a capable mobile-forensics team, and follow Apple’s current security guidance; indiscriminate wiping can destroy evidence and is not a substitute for determining which accounts or secrets were exposed.

For the broader picture, watch the overlap between this kit's infrastructure and known mobile espionage operations. That co-location, combined with a financial theft focus, is the signature of an operation that has matured past one-off attacks and is now building a durable channel into the highest-value phones it can reach.