DarkSword P7 steals iPhone Keychain and crypto on unpatched phones

DarkSword is an exploit chain, a set of linked software bugs that hackers string together to break into a device. Google and iVerify first revealed it in March, alongside a second iPhone hacking kit called Coruna. Google’s researchers said DarkSword combined six vulnerabilities to take over iPhones running iOS 18.4 through iOS 18.7.

At the time, Google said commercial spyware sellers and suspected government-backed hackers were using it, with attacks seen against people in Saudi Arabia, Turkey, Malaysia and Ukraine. Once DarkSword got in, attackers could install extra malware with access to personal data.

P7 is one of those follow-on payloads. iVerify investigated the infection in August and published its report on Oct. 8. The name comes from the attacker’s habit of labeling their code changes with a “p7_” prefix. Compared with the earlier DarkSword variant iVerify had been tracking, which worked up to iOS 18.6, P7 also runs on iOS 18.7. Other DarkSword versions Google had seen already supported that release.

The biggest upgrade is how P7 handles the Keychain, the iPhone’s built-in vault for saved passwords, logins and other credentials. Older versions copied the whole Keychain database and sent it off to be processed elsewhere. P7 extracts what it wants directly on the phone and packages it up before sending it, which hands attackers usable data faster.

It also goes after cryptocurrency. One command looks for crypto wallet apps installed on the phone. Another collects data from imToken, a wallet app that supports several blockchains. That said, finding a wallet file is not the same as controlling the money in it. iVerify has not reported any confirmed crypto theft or any losses.

Then there is remote control. P7 talks both ways with the attacker’s server, checking for new instructions every 15 seconds by default, a gap the operators can change at will. Commands it can carry out include:

• uploading photos and grabbing any file the attacker names;
• reading the Apple Notes database, a common hiding place for passwords and wallet recovery phrases;
• listing the apps you have installed and pulling data from individual apps;
• searching through the phone’s file system.

iVerify says P7 improves on older versions in three areas: stealth, stability and features. It writes fewer logs, injects itself into fewer running processes and uses browser storage to remember which phones it has already hit, so it does not keep re-attacking and crashing the same device.

The result is that warning signs researchers used to catch DarkSword, known as indicators of compromise, no longer work for P7. iVerify also said the changes look like real engineering work by the operators, not quick edits generated with AI tools.

Distribution is the other worry. The group behind P7 spreads it with malicious ads in watering-hole attacks, which means setting a trap on websites lots of people visit and catching whoever passes through. You do not have to be a journalist or an activist to land on a booby-trapped page.

If your iPhone runs iOS 26 with recent updates, or an up-to-date iOS 18, the DarkSword bugs P7 depends on are already closed. iVerify has not shown that P7 can get past Apple’s latest patches, and it did not say which iOS version the infected phone was running.

Apple took an unusual step to cover people who stayed on older software. Rather than only telling everyone to move to iOS 26, it shipped a dedicated iOS 18 security update on March 24, then widened it to more devices on April 1, so phones that could run iOS 26 but stayed on iOS 18 were protected too. It also released fixes for some much older versions. That matters because the group is not small: a survey found that roughly 19 percent of iPhone users were still on iOS 18 at the end of February.

The phones most at risk are the ones that never installed those spring updates.

• Update now. Open Settings, then General, then Software Update, and install whatever is waiting.
• Turn on automatic updates on the same screen so future security fixes arrive without you remembering.
• Use Lockdown Mode if you cannot update. Google’s DarkSword research recommended it for people stuck on older software. It is under Settings, then Privacy and Security.
• Get recovery phrases out of Notes and photos. P7 can read both. Write your wallet recovery phrase on paper and keep it somewhere safe instead.