# The Rise of P7 DarkSword: Stealth and Crypto-Theft Evolve in iOS Exploitation
A newly identified variant of the DarkSword iOS exploit kit, known as P7 DarkSword, represents a significant evolution in mobile malware capabilities. Designed with a focus on stealth and data exfiltration, this latest iteration introduces advanced features that reduce its visibility on compromised devices while maximizing the theft of sensitive financial and personal information.
P7 DarkSword distinguishes itself from earlier versions through a dramatically reduced on-device footprint. The variant eliminates debug logging over HTTP requests and syslog, making it harder to detect during routine forensic analysis. It also utilizes browser localStorage to prevent re-exploitation, ensuring the implant operates cleanly and remains persistent without raising suspicion. Furthermore, P7 has streamlined the handling of stolen credentials; rather than copying and exfiltrating the entire keychain database to the attacker’s infrastructure, the new version extracts keychain data into JSON format directly on the phone prior to sending it out. The malware operates by injecting its payload into SpringBoard, the core iOS process that handles app launches and the home screen, allowing it to manage all communication with the attacker’s infrastructure seamlessly.
The operational capabilities of P7 DarkSword are extensive and highly targeted. Once implanted, the malware polls the attacker’s command-and-control (C2) server every 15 seconds and sends a “heartbeat” message to confirm it remains active. Through this communication channel, the implant can execute a wide array of commands, including running operating system commands like `ls`, `dir`, `ps`, and `whoami`, as well as listing directory contents and downloading files from the device.
Crucially, P7 is heavily geared toward financial and personal data theft. It is equipped to scan for installed cryptocurrency wallets and extract wallet-related data specifically from the imToken wallet app. The malware also exfiltrates iCloud Keychain information and pulls data from popular applications like Apple Notes, Apple Photos, and other app containers. It can recursively scan the filesystem, upload photos from the DCIM directory, and even scan app sandbox directories for specific bundle IDs. Commands allow the attacker to modify the beacon polling interval, execute arbitrary JavaScript within the implant runtime, or completely halt the implant if necessary.
The proliferation of P7 DarkSword is closely tied to the growing ecosystem of exploitation-as-a-service. The exploit kit is frequently deployed alongside a companion payload kit called Coruna. While DarkSword focuses on the initial exploit chain—escaping the browser sandbox and escalating to kernel privileges—Coruna runs inside the victim’s browser session afterward. Coruna’s primary function is harvesting cryptocurrency recovery phrases, balances, and keystore data from iOS applications. In late 2026, infrastructure analysis revealed a combined distribution package known as DS-Fusion v1.0, which bundles both DarkSword and Coruna into a single payload, allowing operators to deploy a comprehensive infection in one go.
Security researchers analyzing open directories on five hosts associated with this ecosystem uncovered the infrastructure powering these operations. These servers hosted the combined DS-Fusion bundle, acted as C2 servers polling compromised devices every few seconds, and even served as analysis workspaces for developing new exploits for unreleased iOS versions. Analysis of the production server’s exploit registry revealed the use of two previously undocumented vulnerabilities: CVE-2025-24201, an out-of-bounds write vulnerability in the WebKit engine, and CVE-2025-31200, a memory corruption flaw in the Core Audio framework.
Attribution points toward a Chinese-speaking threat actor operating an exploitation-as-a-service model, utilizing hosting providers in Tencent and Shenyang, and tied together through a unique self-signed certificate authority. The admin panel of the C2 platform exposed a vast control plane, including a roster of compromised devices, stolen recovery phrases, and an agent/reseller model that allows other financially motivated operators to rent and deploy the kit. A separate operator has also been observed actively using the infrastructure in the wild, targeting BitKeep cryptocurrency wallets and utilizing a distinct C2 server at “6ds[.]lol”.
As recently as last month, intelligence suggests that unauthorized parties have attempted to update the P7 framework to support the latest iOS 26.x operating system, though these attempts have been largely unsuccessful. These updates indicate that the operators are continuously refining the framework’s stability, stealth, and the quality of stolen data to evade evolving mobile security defenses.
## FAQ: Understanding P7 DarkSword and iOS Exploitation
**What makes P7 DarkSword different from earlier variants of DarkSword?**
P7 DarkSword significantly reduces its on-device footprint by removing debug logging and syslog traces. It prevents re-exploitation by using browser localStorage and alters data handling by converting keychain data into JSON on the device before exfiltration, making it more stealthy and efficient than previous versions.
**How does the DarkSword and Coruna combination work?**
DarkSword acts as the initial exploit kit, chaining iOS vulnerabilities to escape the browser sandbox and gain kernel-level privileges. It then injects the main payload into the SpringBoard process. Coruna operates as a secondary payload that runs inside the browser session, specifically focusing on stealing cryptocurrency recovery phrases, wallet balances, and keystore data from iOS applications. Operators frequently use both together via bundles like DS-Fusion v1.0.
**Who is behind the P7 DarkSword attacks?**
While exact attribution is difficult, infrastructure analysis suggests a Chinese-speaking threat actor runs an exploitation-as-a-service operation. The operators use Tencent and Shenyang hosting, and the attacks have targeted individuals in Saudi Arabia, Turkey, Malaysia, Ukraine, and China, with a strong focus on cryptocurrency theft and Apple ID compromise.
**How can iOS users protect themselves from DarkSword?**
The primary defense is keeping devices updated to the latest iOS version, as the exploit kit relies on known vulnerabilities that Apple patches in updates (such as those fixed in iOS 18.3.2 and iOS 18.4.1). Users should also exercise caution with unsolicited links and messages, as the initial infection vector often involves phishing lures, such as fake Snapchat websites or forged invitation invites.
## Conclusion
The emergence of P7 DarkSword highlights the rapid maturation of commercial mobile spyware and the growing accessibility of advanced cyber-espionage tools. By integrating stealth techniques, two-way communication, and specialized crypto-theft modules, P7 represents a dangerous new standard for financially motivated threat actors. The combination of DarkSword and Coruna, distributed through an exploitation-as-a-service model, lowers the barrier to entry for sophisticated iOS attacks. As operators continue to attempt updates for the latest operating systems and refine their data-harvesting capabilities, mobile device users must remain vigilant. Proactive patch management and cautious digital behavior remain the most critical defenses against these highly advanced and evolving threats.
Thank you for reading
