P7 DarkSword: new hidden variant steals iCloud Keychain and wallets data in iOS

Cybersecurity researchers have documented a new and more insidious variant of the iOS operating kit known as DarkSword: baptized as P7 DarkSword. According to technical reports published by signatures following the mobile malware track, this version reduces the trace on the device, adds direct theft of key key data (iCloud Keychain) and cryptomoneda applications, and establishes a bidirectional communication with the attacker's infrastructure, making the infection a complete door for sensitive data control and exfiltration.

Confirmed, DarkSword is a kit that links several iOS vulnerabilities to escape from the browser sandbox, scale privileges to the kernel and finally inject an implant into SpringBoard - the process that manages the app launcher and the main interface on iPhone -. This implant is the component that maintains persistence and hears remote orders. Previous public investigations, including those of academic groups and security companies, place DarkSword's first detections in nature since November 2025 and relate it to attacks on users in countries such as Saudi Arabia, Turkey, Malaysia and Ukraine.

In the specific case of P7, technical analyses report several operational differences with respect to previous variants: instead of copying the database from the key to the attacker's server, P7 transforms it into JSON in the device itself before sending it; it eliminates different debugging records in HTTP and syslog to clean its trace; and uses local browser storage (localStorage) as a measure to prevent re- accidental holdings or to activate repeated chains. In addition, the SpringBoard-injected implant makes regular polling (every ~ 15 seconds in the samples analyzed), sends heartbeat, list of installed applications and can transmit iCloud Keychain data, notes, photos and data from numerous wallet apps.

The remote commands observed in the samples include system command execution, file listing and download, memory dumping, collection of disk metadata, data extraction of specific applications, scanning and data extraction of wallets and uploading of Apple Notes photos and databases. The capacity to adjust the beaconing cadence and to stop the implant has also been seen, confirming that we are talking about an interactive backdoor with granular control over the compromised device.

It is a confirmed fact that financial actors and malicious businesses have used DarkSword and its ecosystem: researchers have documented its use alongside the Coruna kit - designed to steal recovery phrases and wallets keystors - and campaigns that take advantage of compromised or re- registered domains to disperse the malicious code. A specific case documented by security specialists shows that the domain of an electronic commerce analytics service expired and was reregistered, and its monitoring script was modified to redirect visitors to operating chains and fraud pages serving DarkSword's burden.

What is confirmed and what is not. Confirmed: the existence of the P7 variant, its SpringBoard injection technique, the JSON removal of the key chain on the device and the list of remote commands that allows to exfilter photos, notes, app lists and wallets data. It is also verifiable that the kit has been distributed through malicious websites and committed third party labels. Estimated but not publicly proven: the final attribution of operations to a State actor or to a specific organization; the reports point to several operators with financial motivation and alleged Chinese infrastructure, but the researchers stress that the exact authority remains without public confirmation. Still uncertain is the extent to which reimplemented or "reclaimed" versions by new actors (possibly assisted by LLM models) are operating on a large scale: failed attempts to carry the platform to iOS 26.x have been detected, but the effectiveness of these attempts varies.

In technical terms, the threat combines three factors that make it dangerous: operation in the browser for initial entry, lifting to kernel to avoid system limitations, and persistence within SpringBoard for continuous access and extensive data collection. The combination with Coruna or similar modules adds a clear focus on monetizable assets: billet credentials, recovery phrases and cryptoactive balance sheets.

Who it affects. Mainly to iPhone users whose iOS version is vulnerable (the initial variants pointed to ranges such as iOS 18.4-18.7), but also to shops and web platforms that include third-party scripts in their stores: expired or poorly managed analytical labels can become mass distribution vectors. In addition, third-party infrastructure operators (CDN, ad networks, tracking plugins) become risk multipliers when a label is compromised or reregistered.

The practical consequences for a victim are severe: loss of iCloud Keychain secrets (passwords and tokens), exposure of private photos and notes, theft of recovery phrases and crypto keys, and remote control of device functions that allow continued espionage. For high-value objectives (users with cryptomoneda holdings, journalists, executives, dissidents), the commitment can result in financial losses and risks of blackmail or dissemination of sensitive information.

What a user or a web administrator should do right now. First, update iPhone and iPad to the latest iOS version available through Apple's official security updates page: https: / / support.apple.com / en-us / HT201222. The vulnerability corrections that allow sandbox escape and kernel execution are the most reliable defense. Second, if you suspect that your device could be compromised (strange behavior, unusual network activity, initial session notifications), make a secure backup of essential data, restore the device to factory settings and restore from a clean backup or reconfigure from scratch; after re-establishment, change critical passwords and enable 2FA into important accounts. Third, for users with cryptomonedas: assume that keys and phrases could have been exposed if the device was compromised; move funds to a portfolio created on a new and safe device or to a hardware walk; do not reuse phrases or keys on the compromised device.

For online store managers and third party integrators: check that analytical or marketing labels and scripts are under control, check the ownership of domains associated with their tags and disable or update third party integrations that are no longer active. Reporting to service providers the re-registration of expired domains and regularly auditing the content served by third parties reduces the risk that a malicious script will infect visitors. Network managers and incident response teams should monitor commitment indicators described by firms investigating the campaign and block identified domains and PIs while being investigated.

For more context on analysis and detection related to this ecosystem of exploitation and theft of wallets, researchers have published independent findings and research teams keep pages with infrastructure and artifacts tracking: consult public resources from teams specialized in threat detection and web security, such as Censys ( https: / / censys.io /) and third-party label and script integrity analysis platforms such as Report URI ( https: / / report-uri.com /), where re-use of domains and distribution by contaminated labels have been documented.

In conclusion: P7 DarkSword is an operational evolution of the DarkSword / Coruna ecosystem that prioritizes discretion and extraction of valuable assets. Effective mitigation depends on timely iOS parking, hygiene in the management of third-party scripts on websites, and clear contingency procedures for cryptomoneda users and administrators who detect signs of commitment.