P7 DarkSword spyware variant targets iPhone credentials

Security firm iVerify has identified P7 DarkSword, an evolved variant of the DarkSword spyware targeting iPhones. The discovery follows an investigation into an infection found in August 2026 on a device belonging to a financial institution employee.

Rather than exploiting a brand-new iOS vulnerability, P7 DarkSword acts as an update to existing malicious software that deploys after an initial compromise. This variant is designed for increased stealth, reducing the number of process injections and logs generated to avoid detection by monitoring tools. It also utilizes browser storage to minimize repeated exploitation of the same device.

The malware is capable of accessing sensitive data, including Apple Keychain passwords, notes, photographs, installed application lists, and cryptocurrency wallet information. While documented cases have been linked to Turkey, Malaysia, Saudi Arabia, and Ukraine, the threat is considered a broad risk to both personal and corporate iPhone users.