Security firm iVerify disclosed a new iPhone spyware variant, designated P7 DarkSword, on October 8 after investigating an infection detected in August. The malware can remotely extract cryptocurrency wallet data and sensitive credentials from compromised devices, presenting a significant risk to users who store digital assets on mobile phones.
The spyware includes commands that specifically target cryptocurrency wallet applications and can collect passwords, photos, and personal information. The discovery underscores an emerging vulnerability: attackers who gain access to a device could obtain sensitive information without exploiting weaknesses in the wallet application itself.
How P7 Targets Cryptocurrency Wallets
According to iVerify's technical investigation, P7 includes two dedicated functions for cryptocurrency-related collection:
- wallet_scan: Searches compromised devices for installed wallet applications, allowing attackers to identify potential targets
- wallet_extract: Designed to collect data associated with imToken, a cryptocurrency wallet supporting multiple blockchain networks
Together, these functions enable attackers to identify cryptocurrency users and retrieve wallet-related files after gaining device access. The spyware also targets Apple's Keychain system, which stores passwords and authentication credentials.
Extended Capabilities and Detection Evasion
P7 demonstrates a significant evolution in spyware design. Rather than relying on predetermined collection processes, the malware communicates with an attacker-controlled server every 15 seconds by default, requesting instructions that can be executed on the infected phone. Operators can adjust that interval, search for specific files, and initiate additional collection activities without requiring another device compromise.
The spyware can also collect Apple Notes databases, photographs, and selected application files, which may contain sensitive financial information such as recovery phrases or wallet credentials if users stored them there.
Researchers identified modifications intended to make the spyware harder to detect, including eliminating certain diagnostic logs, reducing process injections, and using browser storage to prevent repeated exploitation attempts that could destabilize the infected device.
Context and Vulnerabilities
P7 represents an evolution of the DarkSword iPhone exploitation framework previously used by multiple surveillance operators. In March, Google's Threat Intelligence Group reported that DarkSword combined six vulnerabilities to compromise iPhones running certain versions of iOS 18.4 through 18.7. Google identified campaigns involving commercial surveillance vendors and suspected state-backed attackers targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine.
Apple has already addressed the vulnerabilities associated with the documented DarkSword exploitation chain. According to the company's security advisory, protections became available in 2025, with iOS 18.7.7 released on March 24, 2026, expanding to additional devices on April 1.
Apple recommends installing the latest compatible software and enabling automatic updates. Google's earlier DarkSword research also recommended Lockdown Mode when updating is not possible. iVerify did not disclose evidence of completed cryptocurrency theft or quantify financial losses from the malware.
