Researchers have disclosed P7, a new variant of the DarkSword iOS exploit kit that steals data from more than 25 crypto-wallet apps and adds two-way command and control, remote command execution and on-device keychain extraction. The variant targets iPhones running iOS 18.4 through iOS 18.7, and its operators have also tried to support iOS 26.x.
P7 Adds Crypto-Wallet Theft and Remote Commands to DarkSword
The P7 variant extracts data from 25 or more crypto-wallet apps, with dedicated extraction routines for imToken and BitKeep. That focus on mobile wallets gives the kit a direct financial purpose beyond surveillance.
P7 also expands how operators control an infected device. It supports two-way command and control and remote command execution, with the implant polling for instructions every 15 seconds. It can pull the iOS keychain off the device and write it out to JSON, and it can exfiltrate photos, notes and SMS messages.
Keychain Extraction and 15-Second Command Polling
The keychain extraction is the capability with the broadest reach. The keychain holds stored credentials on an iPhone, so dumping it to JSON hands the operator a file of saved logins in addition to wallet data. The 15-second polling interval means the operator can issue commands to the device and receive results within seconds.
Chinese-Speaking Actor Behind the August Campaign
Researchers identified a Chinese-speaking, financially motivated actor in a campaign during August. The actor re-registered domains in September to distribute the kit. Targeting has been seen in Saudi Arabia, Turkey, Malaysia and Ukraine.
The financial motivation fits the wallet-theft focus of P7. Researchers attribute the August activity to that actor, while the wider kit family has been linked to other parties.
Links to PARS Defense and Star Blizzard
The broader kit family has been linked to PARS Defense and to Star Blizzard, also tracked as COLDRIVER. Those associations come from analysis of the family as a whole, and they sit alongside the finding that a financially motivated Chinese-speaking actor ran the August campaign using the kit.
DarkSword and Coruna: Affected iOS Versions
DarkSword targets iPhones on iOS 18.4 through iOS 18.7. A companion kit, Coruna, targets iOS 13.0 through iOS 17.2.1. Together the two kits cover a wide span of iPhone software releases. Attempts to support iOS 26.x have also been reported, though the research does not state that those attempts succeeded.
A Kit Seen in the Wild Since November 2025
DarkSword has been seen in the wild since November 2025, and it was first documented publicly in March. The researchers who have analyzed it include iVerify, Google GTIG, Lookout, Censys and Report URI. The P7 variant was disclosed on October 11, extending a body of work that has tracked the kit through several versions.
Impact: Wallet Theft and Full-Device Surveillance on Unpatched iPhones
The impact of P7 falls on users whose iPhones have not been updated. The variant gives its operators the ability to drain data from mobile crypto wallets and, with the keychain, photos, notes and SMS, to monitor a device broadly. Remote command execution adds the ability to act on the phone rather than only copy data from it.
Researchers have published their analysis of the variant. Users on older iOS versions are advised to update.
What the P7 Disclosure Leaves Unanswered
The research describes the capabilities and targeting of P7 but does not give a count of infected devices or of stolen funds. It also does not say how many of the 25-plus wallet apps the kit has successfully drained in practice. Those figures would show how much real theft the variant has produced since its distribution domains went live.
The spread of the DarkSword family across criminal and state-linked users, as reflected in the associations with PARS Defense and Star Blizzard, means a variant built for financial theft shares a code lineage with tools tied to other groups.
