[REVISION HISTORY]

P7 DarkSword iPhone spyware discovery and evolution

Updated 3 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-26 01:13 UTC → 2026-10-26 07:47 UTC · added ~~removed~~

Cybersecurity firm iVerify has identified P7 DarkSword, an advanced evolution of the DarkSword spyware specifically targeting iPhone users. The malware is designed for high stealth and stability, utilizing techniques such as removing HTTP requests, reducing process injections, and minimizing debug logs to avoid detection by monitoring tools. Technical analysis indicates that the spyware establishes bidirectional remote control, allowing attackers to execute commands like file reading, disk scanning, and JavaScript execution. It specifically targets sensitive information, including Apple Notes, photo galleries, application data, Apple Keychain passwords, and encrypted cryptocurrency wallets such as imToken. Recent investigations reveal that P7 DarkSword may act as an update to existing malicious software deployed after an initial compromise, utilizing browser storage to minimize repeated exploitation. The malware establishes communication with attacker-controlled servers every 15 seconds. While documented cases have been linked to Turkey, Malaysia, Saudi Arabia, and Ukraine, the threat is considered a broad risk to both personal and corporate users. Further research indicates the DarkSword campaign targets iPhone and iPad users managing cryptocurrencies by exploiting vulnerabilities in iOS versions 18.6 through 26.1. This Trojan breaks through application sandboxing to steal private keys and confidential notes. SlowMist has identified over 1,500 phishing websites connected to this ~~campaign.~~ campaign, which impersonate major cryptocurrency exchanges like Binance and OKX, as well as e-commerce and gaming platforms. In response to the escalating threat, major Vietnamese banks, including Agribank, VietinBank, and BIDV, have issued urgent warnings to iPhone users. These institutions advise customers to update their iOS to the latest compatible version and to avoid clicking suspicious links or providing credentials on untrusted websites to prevent the theft of passwords and authentication credentials.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.