A newly documented variant of the DarkSword iOS exploit kit adds cryptocurrency wallet data theft, on-device keychain extraction and two-way command-and-control communication, according to a report by mobile security firm iVerify published October 8 and detailed by The Hacker News on October 12.

The variant, dubbed P7 DarkSword, differs from earlier DarkSword versions in three ways that matter for anyone holding crypto on an iPhone.

What changed

  • A smaller on-device footprint. The new variant leaves fewer traces for detection tools or manual review — fewer artifacts, less to catch.
  • On-device keychain and wallet theft. Previous variants copied and exfiltrated the raw keychain database so attackers could process it on their own infrastructure, according to The Hacker News. P7 extracts keychain data into JSON on the phone before exfiltration, along with data from installed cryptocurrency wallet applications — and, per coverage of the report, photos and notes.
  • Two-way C2. Where earlier variants relied on a fixed payload, P7 establishes bidirectional communication with attacker infrastructure, letting operators send new instructions to an infected phone after the initial compromise — for example, tasking it against a newly installed wallet app or pausing activity to avoid detection.

Together, the changes describe a toolkit built for sustained, financially motivated access rather than a one-time grab.

What remains unknown

iVerify's report does not specify the initial infection method, name the wallet applications targeted, or provide a victim count. Those details should be treated as unconfirmed rather than assumed — no delivery mechanism (malicious link, compromised app, or otherwise) has been documented. What is established is the capability set itself: keychain access, wallet data theft, and remote tasking.

Defense, and an awkward irony

Standard defenses apply: keep iOS and apps current, enable Lockdown Mode on high-value devices, treat new configuration profiles or unexplained battery drain as reasons to investigate, and have MDM flag unauthorized profile installs. The standard advice for meaningful holdings — move them off general-purpose phones onto hardware wallets — collides awkwardly with a month in which the hardware wallet supply chain is itself under strain: read TrustGrade's coverage of the CryptoBilis reseller incident and Ledger's confirmed hardware implant before choosing where and how to buy one.

P7 DarkSword extends a run of iOS threats against crypto holders documented this year, including September's FomoPeek malware distributed through the App Store and the earlier SparkKitty campaign. The mobile attack surface is no longer the perimeter of crypto security — for many holders, it is the whole perimeter.

TrustGrade tracks the security posture of platforms and protocols in digital assets. Verified trust data: trustgrade.ai.