The Rise of P7 DarkSword: A New Threat to iPhone Crypto Security

Security researchers have identified a sophisticated new iPhone spyware variant, dubbed P7 DarkSword, specifically engineered to plunder cryptocurrency wallets and sensitive credentials. Disclosed by the security firm iVerify, this malware represents a significant evolution in mobile threats, shifting focus from general surveillance to targeted financial theft by exploiting the underlying device's data rather than the wallet applications themselves.

Targeted Extraction of Digital Assets

The P7 variant employs specialized functions designed to hunt for and harvest cryptocurrency-related data. Through a command known as wallet_scan, the spyware identifies installed wallet apps, while wallet_extract specifically targets files from services like imToken. Beyond dedicated apps, the malware aggressively pursues Apple’s Keychain—the system’s secure password vault—converting sensitive login info into immediately usable JSON files. It also scans Apple Notes and photo libraries for recovery phrases or private keys, turning a user's digital backups into a goldmine for potential attackers.

Advanced Remote Control and Stealth

What sets P7 DarkSword apart is its enhanced persistence and remote-control framework. The spyware communicates with an attacker-controlled server every 15 seconds, allowing operators to issue real-time commands and adjust their collection strategy without needing to re-infect the device. To avoid detection, the developers have streamlined the malware by eliminating diagnostic logs and reducing process injections that could cause system instability. This shift toward a "quieter" presence suggests a move toward long-term, sustained monitoring of a victim's financial activities.

Mitigation and the Path to Safety

While the capabilities of P7 are formidable, its success relies on an initial device compromise. The discovery follows a history of DarkSword exploitations that utilized various iOS vulnerabilities, most of which Apple has already addressed in recent security updates. Although there is no current evidence that P7 can bypass the latest iOS protections, the evolution of the spyware underscores the necessity of maintaining up-to-date software. Security experts continue to recommend enabling automatic updates and utilizing Apple's "Lockdown Mode" for high-risk individuals to thwart these sophisticated surveillance tools.