Mobile security company iVerify has identified a reworked version of the DarkSword iPhone spyware that can pull Keychain passwords, raid cryptocurrency wallets and take orders from its operators, 9to5Mac reported Thursday. The variant, which iVerify calls P7, only works against iPhones that have not installed Apple's security updates.

What Happened

iVerify found P7 in August while investigating an infected iPhone that belonged to an employee of a financial institution, according to 9to5Mac. In its own write-up, the company said it pulled forensic artifacts from the device and then used the Validin threat-hunting platform to locate the variant on a suspicious domain whose activity matched the infection timeline.

The name comes from the "p7_" prefix the attackers attached to variables in the code they changed. iVerify does not tie P7 to a specific actor. Its researchers said the modifications showed real effort by competent operators rather than code assembled with AI tools.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

P7 does not introduce a new vulnerability. It is a post-compromise implant delivered through the existing DarkSword exploit chain, which targets iOS 18.4 through iOS 18.7. According to 9to5Mac, the new version extends support to iOS 18.7, while the earlier tooling stopped at iOS 18.6.

What the Variant Can Do

Earlier DarkSword builds copied the whole Keychain database off the phone for processing elsewhere. P7 instead extracts Keychain contents on the device and packages them as JSON before sending them out.

The bigger change is two-way command-and-control. By default the implant checks in with attacker servers every 15 seconds, an interval that can be changed remotely. On command it can fetch arbitrary files, upload photos, list installed apps, read the Apple Notes database, scan the file system, collect app container data and run arbitrary JavaScript. It also targets crypto wallets.

The operators also made the tool harder to spot. iVerify said P7 drops debug logging over HTTP and to the system log, performs fewer process injections and uses browser localStorage to avoid exploiting the same device twice.

Why It Matters

DarkSword was disclosed earlier this year by Google and iVerify, who documented its use in Saudi Arabia, Turkey, Malaysia and Ukraine and linked it to several commercial surveillance vendors and suspected state-sponsored actors. P7 shows that at least one group is still investing in the kit months after the underlying flaws were fixed.

Delivery has also widened. P7 is spread through malicious ads and watering-hole attacks, in which attackers plant exploit code on websites their targets visit, so it can reach anyone browsing on an outdated iPhone rather than a short list of chosen victims. For a bank or other financial firm, an infected employee phone carrying saved credentials and wallet keys is a direct route to corporate and customer accounts.

Apple has shipped fixes in iOS 15.8.7, iOS 16.7.15 and iOS 18.7.7, along with its current releases.

What to Watch

iVerify has published detection material, including two command-and-control servers, more than 40 file hashes, over 200 domains tied to DarkSword infrastructure, file system artifacts and hardcoded network headers. Security teams can use those indicators to check managed iPhones, while the simplest defense for users remains installing the latest iOS update. Further reports may show whether P7's operators are linked to the groups behind earlier DarkSword campaigns.