The iPhone that gave P7 DarkSword away belonged to a customer of the mobile security firm iVerify. In August 2026 the company's software flagged a DarkSword infection on the device that did not quite match the usual pattern, and with the customer's consent its analysts pulled forensic artifacts from the phone and found a variant of the exploit kit that nobody had documented before.
iVerify published its analysis on October 8. The variant takes its name from the p7_ prefix its authors put on their variables, and it keeps the DarkSword exploit chain while reworking the implant that follows it: fewer traces on the phone, keychain decryption on the device instead of shipping the whole database out, a hunt for cryptocurrency wallet apps, and a two way command channel that lets the operators steer each infection.
What DarkSword is
DarkSword is an entire exploit chain for iPhones, written in JavaScript. A victim need only load a booby trapped page in Safari; the code escapes the browser sandbox, climbs to kernel privileges and installs an implant. Google's Threat Intelligence Group, iVerify and Lookout documented it in March 2026. Google reported that the chain uses six vulnerabilities, works against iOS 18.4 through 18.7 and had been in use since at least November 2025 by commercial spyware vendors and suspected state backed groups, with victims in Ukraine, Turkey, Malaysia and Saudi Arabia.
Apple closed the last of the six flaws in iOS 26.3 in February 2026, but the kit did not die with the patch. iVerify says a third party leaked DarkSword's source code soon after the joint publication, and clusters of variants have appeared since, among them several failed attempts, apparently made with the help of large language models, to port the kit to iOS 26. P7 is not one of those. Its authors knew what they were doing with the code, iVerify says, and their modifications shrink the implant's footprint while widening what it can steal.
Fifteen seconds between orders
Once P7 is on a phone, the implant injects into SpringBoard, the process behind the home screen, and that single process handles all contact with the attackers' server. Every 15 seconds by default it sends a beacon and receives a list of jobs; a sleep command lets the operators change the interval from afar. The job list reads like a remote administration tool: list directories, download files, pull pictures from the camera roll, enumerate installed apps, run arbitrary JavaScript inside the implant, or walk the entire filesystem and report what is there.
The theft modules show where the money is. Earlier DarkSword builds copied the keychain database wholesale and processed it on the attackers' side; P7 extracts the entries into JSON on the phone before uploading, which means less data in transit and less to notice. Dedicated handlers scan for installed wallet apps, pull data out of the imToken wallet, copy the Apple Notes databases and query the Photos library for recent pictures, two places where photographed or typed recovery phrases tend to end up.
Checking a phone
iVerify has listed the traces P7 leaves behind. The implant writes its working files to /private/var/tmp, among them keychain_c2_dump.json, p7_debug.log and c2_wallet_debug.log, plus copies of the Notes database under names starting with _hq_notestore. It leaves markers in Safari's localStorage so the same browser is not exploited twice, and every request to its servers is an HTTP/1.0 POST with a hardcoded user agent string claiming to be an iPhone on iOS 18.5. The report also names the exploit and command domains and gives hashes for each component.
The fix for the chain itself has existed for months. Anyone still on iOS 18 should be on 18.7.6 or later, and anyone on iOS 26 on 26.3.1 or later, the versions iVerify named in March as closing every flaw used by DarkSword and Coruna; Google advises people who cannot update to switch on Lockdown Mode. A phone that carries the files above, or that has visited the domains in iVerify's indicator list, should be treated as compromised: wipe it, change every password the keychain held, and move any cryptocurrency to wallets created on a clean device.
The wider point is who holds the kit now. DarkSword was first seen in the hands of surveillance vendors and state backed groups; since the leak it has been picked up by operators ranging from the incompetent to, in P7's case, the clearly capable, and iVerify has also seen it bundled with Coruna, a second leaked kit for older iOS versions, in a package it calls DarkCoruna. The P7 case began with a detection that merely looked slightly off; following it up produced a new sample, a fresh set of indicators and a clearer picture of a kit that keeps finding new owners.
