A newly identified variant of aggressive iPhone spyware is targeting unpatched devices to harvest personal photos, passwords, and digital currency credentials, according to mobile security researchers. The malware strain, dubbed P7 DarkSword, was uncovered by security firm iVerify after its monitoring systems flagged anomalous activity on an infected customer handset in August 2026, Fox News reported.
How P7 DarkSword operates
Researchers revealed details of the threat in an Oct. 8 report, explaining that the P7 DarkSword variant represents an evolution of an existing spyware framework. Once an iPhone is compromised, the malware can beacon back to remote command infrastructure as frequently as every 15 seconds to receive instructions, iVerify reported. Attackers can remotely modify this communication interval, scan internal storage, and run arbitrary JavaScript within the active device environment.
Analysis indicated that the software injects its communications module directly into SpringBoard, the core operating system process responsible for the iOS Home Screen. By eliminating specific diagnostic logs and suppressing background tasks that typically alert investigators, the authors designed P7 DarkSword to remain discreet. Once embedded, the program can access keychain records, stored Wi-Fi credentials, chat logs, device location history, and files tied to cryptocurrency wallets, GBHackers News reported.
Mercenary tools shift to cybercriminals
The underlying software originated as high-priced surveillance technology developed for targeted operations before its source code leaked into the public domain, Apple told CyberGuy. Mobile security architect Akili Akridge, speaking on the Packet Protector podcast, likened the dispersion of these tools to conventional arms dealing, noting that zero-day exploits initially produced for state missions frequently leak through breaches or insider theft.
DarkSword is often coupled with another exploit kit named Coruna, which Google’s Threat Intelligence Group traced across multiple operations, including suspected espionage campaigns and financially motivated schemes. Researchers documented that Coruna features 23 distinct exploits spanning iOS 13.0 through 17.2.1, while DarkSword was crafted to target iOS 18.4 through 18.7. At the Black Hat 2026 conference, iVerify demonstrated how threat actors deploy both tools simultaneously from a single deceptive website—a blended attack termed DarkCoruna designed to strike a wide range of older software versions in a single visit.
These watering-hole attacks lure victims to compromised websites or fraudulent financial portals, where browser vulnerabilities in WebKit permit code execution before chaining sandbox escapes and kernel exploits. According to iVerify telemetry, observed attacks targeting vulnerable devices rose from 1.5 percent in August 2026 to 5 percent in September 2026.
Defense and device protection
Apple stated that it addressed the vulnerabilities used in these attacks in 2025, prior to the initial leaks, and issued a follow-up patch in March 2026 for legacy hardware. The company confirmed that devices running fully updated releases—spanning iOS 15 through the current iOS 27 platform—remain shielded from known DarkSword exploits. Security analysts noted they have not observed P7 DarkSword successfully compromising fully patched operating systems.
For high-risk users, Apple’s built-in Lockdown Mode successfully halts the exploit chains, iVerify confirmed. However, Akridge cautioned that the mode must be activated prior to visiting a hostile page and heavily curbs standard functionality, restricting message attachments, disabling incoming calls from unfamiliar contacts, and preventing new mobile device management enrollments.
Security specialists recommend keeping devices updated to the latest available iOS build, using separate hardware to reset compromised passwords, and maintaining continuous endpoint monitoring across corporate networks to detect low-level device anomalies.
