P7 DarkSword spyware targets iPhone users with advanced remote control

Cybersecurity firm iVerify has disclosed a highly advanced new variant of the DarkSword spyware, dubbed P7 DarkSword, which targets iPhone devices. The malware is designed to be more stealthy and stable than previous versions, utilizing techniques to reduce its digital footprint, such as removing HTTP requests and debug logs.

Technical analysis reveals that the spyware establishes bidirectional remote control communication, sending requests to an attacker-controlled server every 15 seconds. This allows attackers to execute commands such as file reading, photo uploading, disk scanning, and JavaScript execution. The malware specifically targets sensitive information, including Apple Notes, photo galleries, application data, and Keychain data.

A notable capability of this variant is its ability to scan for and extract data from encrypted cryptocurrency wallets, such as imToken. Researchers suggest that attackers may be distributing this malware through malicious advertisements. Unlike earlier versions that focused on one-way data leaks, P7 DarkSword provides attackers with near-total control over the infected device.