[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

4 clusters · 21 sources · 17 days · First seen · Last updated

P7 DarkSword iPhone spyware discovery and evolution

Overview

Cybersecurity firm iVerify has identified P7 DarkSword, an advanced evolution of the DarkSword spyware specifically targeting iPhone users. The malware is designed for high stealth and stability, utilizing techniques such as removing HTTP requests, reducing process injections, and minimizing debug logs to avoid detection by monitoring tools. Technical analysis indicates that the spyware establishes bidirectional remote control, allowing attackers to execute commands like file reading, disk scanning, and JavaScript execution. It specifically targets sensitive information, including Apple Notes, photo galleries, application data, Apple Keychain passwords, and encrypted cryptocurrency wallets such as imToken.

Recent investigations reveal that P7 DarkSword may act as an update to existing malicious software deployed after an initial compromise, utilizing browser storage to minimize repeated exploitation. The malware establishes communication with attacker-controlled servers every 15 seconds. While documented cases have been linked to Turkey, Malaysia, Saudi Arabia, and Ukraine, the threat is considered a broad risk to both personal and corporate users.

Further research indicates the DarkSword campaign targets iPhone and iPad users managing cryptocurrencies by exploiting vulnerabilities in iOS versions 18.6 through 26.1. This Trojan breaks through application sandboxing to steal private keys and confidential notes. SlowMist has identified over 1,500 phishing websites connected to this campaign, which impersonate major cryptocurrency exchanges like Binance and OKX, as well as e-commerce and gaming platforms.

In response to the escalating threat, major Vietnamese banks, including Agribank, VietinBank, and BIDV, have issued urgent warnings to iPhone users. These institutions advise customers to update their iOS to the latest compatible version and to avoid clicking suspicious links or providing credentials on untrusted websites to prevent the theft of passwords and authentication credentials.

Entities

Apple · iVerify · McAfee · Darksword · OKX

Claims

What the coverage asserts, and how many sources carry each claim.

Timeline

  1. [TECHNOLOGY] 4 sources
    Vietnamese banks warn iPhone users of P7 DarkSword malware

    Vietnamese banks Agribank, VietinBank, and BIDV have warned iPhone users to update iOS to protect against the P7 DarkSword malware, which targets personal data and banking credentials.

  2. [TECHNOLOGY] 7 sources
    DarkSword malware targets iPhone crypto users via 1,500 phishing sites

    SlowMist warns of ‘DarkSword’ malware targeting iPhone users through 1,500+ phishing sites to steal crypto private keys and sensitive data by exploiting iOS vulnerabilities.

  3. [TECHNOLOGY] 2 sources
    P7 DarkSword spyware variant targets iPhone credentials

    iVerify has identified P7 DarkSword, a stealthy iOS spyware variant capable of stealing Apple Keychain credentials and cryptocurrency wallet data from compromised iPhones.

  4. [TECHNOLOGY] 8 sources
    P7 DarkSword spyware targets iPhone users with advanced remote control

    Security firm iVerify has identified P7 DarkSword, an advanced iPhone spyware variant capable of bidirectional remote control and stealing sensitive data, including photos, notes, and crypto wallets.

Sources

actualidadiphone.com · ad-hoc-news.de · afamily.vn · bittimes.net · borncity.com · cafef.vn · criptotendencias.com · cyberinsider.com · cybernoz.com · eloutput.com · iphoneaddict.fr · ithome.com · kenh14.vn · kurierverlag.de · linformatique.org · noz.de · op-online.de · pctipp.ch · shiftdelete.net · soha.vn · u.today

This summary has been updated 3 times: see revision history