P7 DarkSword iOS exploit kit adds keychain and crypto wallet theft with two-way command channel

iVerify detailed P7 DarkSword, a new variant of the commercial DarkSword iOS exploit kit that has circulated among financially motivated and other actors since late 2025. It reduces its on-device footprint and adds on-device keychain and cryptocurrency wallet theft plus two-way command-and-control, running inside SpringBoard and polling for commands every 15 seconds. Collected data includes iCloud Keychain, Apple Notes, Photos, and wallet contents, with commands for disk, wallet, and photo scanning and file transfer. The chain exploits WebKit and Core Audio flaws, CVE-2025-24201 and CVE-2025-31200, patched in earlier iOS releases, and is distributed through fake websites, poisoned analytics domains, and bogus crypto platforms.

Check

Keep iOS devices updated to the latest release, and for high-risk users enable Lockdown Mode and watch for the distribution lures iVerify describes.

Affected

iPhones on older iOS versions reachable by the DarkSword chain can have keychain, Notes, Photos, and cryptocurrency wallet data stolen and receive remote attacker commands.

Fix

Update iOS promptly, enable Lockdown Mode for targeted individuals, avoid untrusted links and crypto sites, and monitor for the malicious domains and analytics tags iVerify and Report URI list.