P7 DarkSword: An Advanced iOS Exploit Kit Discovered

Cybersecurity researchers have unveiled a new variant of the DarkSword iOS exploit kit, identified as P7 DarkSword. This iteration showcases several enhancements over its predecessors, particularly in the realms of data theft and communication with the attacker’s infrastructure.

Key Features of P7 DarkSword

According to a report from iVerify, P7 DarkSword distinguishes itself by minimizing its on-device footprint, integrating capabilities for stealing data from on-device keychains and cryptocurrency wallets, and facilitating two-way communication with the attacker’s command and control (C2) systems.

Origins and Functionality

The exploit kit, originally detailed in March 2026 by Google Threat Intelligence Group along with partners iVerify and Lookout, was designed to target iPhones operating on iOS versions 18.4 to 18.7. Its first detection in the wild occurred in November 2025.
DarkSword employs a sophisticated method that exploits multiple vulnerabilities in iOS to bypass browser sandboxes, elevate privileges to kernel level, and load its main payload into the SpringBoard process, responsible for app launches and the home screen on iOS devices.

Targeted Attacks and Global Reach

The toolkit has been actively used in cyberattacks across various countries, including Saudi Arabia, Turkey, Malaysia, and Ukraine. It has been associated with multiple threat actors, notably a Turkish surveillance vendor known as PARS Defense, which used a fake Snapchat-themed website for distribution, and a Russia-aligned group called Star Blizzard, which employed deceptive invitation links.

Recent Developments

In a related development, an unknown Chinese-speaking hacker group recently conducted campaigns targeting iOS devices using the DarkSword toolkit, alongside a decoy Apple ID sign-in page, as reported by Censys in August 2026. Furthermore, attempts to upgrade the framework to support iOS 26.x have been observed, highlighting the dynamic evolution of the threat landscape.

Functionality Enhancements

P7 DarkSword advances its predecessors by eliminating debug logging over HTTP and system logs and utilizing browser localStorage, thereby enhancing stealth capabilities and preventing re-exploitation. Unlike previous iterations, which exfiltrated the keychain database to external servers, P7 now extracts this information in JSON format directly on the device before transmission.

Capabilities of the Implant

The new variant operates by injecting into the SpringBoard process, allowing it to perform various functions on the infected device. This includes:

• execute_command: Execute operating system commands.
• ls: List directory contents.
• download: Read files and upload them to the C2 server.
• photos: Upload photos from specified directories.
• apps: Enumerate app containers and extract bundle IDs.
• exec: Run JavaScript within the implant runtime.
• file_upload: Scan and upload matching files.
• basic_info: Transmit device metadata.
• disk_scan: Perform a recursive filesystem scan.
• ios_app_data: Upload selected app files from the app sandbox.
• wallet_scan: Detect installed wallet applications.
• wallet_extract: Extract data from specific wallet apps.
• memo_scan: Upload Apple Notes databases.
• photo_scan: Gather photos from the Photos app.
• sleep: Adjust polling intervals.
• exit: Halt the implant’s operations.

Recent Findings and Ongoing Research

Censys researchers have reported open directories on multiple hosts related to DarkSword and another emerging iOS exploit kit known as Coruna. DarkSword and Coruna are often employed in concert, with Coruna functioning as a complementary payload for executing attacks focused on collecting sensitive cryptocurrency wallet information.

Host Details Linked to DarkSword

Notable hosts involved in the distribution or exploitation through DarkSword include:

• 43.134.165[.]205 – Serves a combined package of DarkSword and Coruna.
• 166.88.95[.]90 – Operates as a C2 server with activity logged from real iOS device polling.
• 23.148.212[.]237 – An analysis workspace for developing exploit chains.
• 47.102.192[.]23 – Staging host for the Coruna kit.
• 156.239.230[.]120 – Exposes an entire C2 platform with extensive activity.

Identified Vulnerabilities

Research has pinpointed two unreported CVE identifiers related to DarkSword:

• CVE-2025-24201: An out-of-bounds write vulnerability in WebKit, allowing escape from the Web Content sandbox (fixed in iOS 18.3.2).
• CVE-2025-31200: A memory corruption vulnerability in Core Audio, enabling code execution through malformed media files (fixed in iOS 18.4.1).

Conclusion

As the DarkSword exploit kit continues to evolve, the increasing sophistication of its variants underscores a growing threat to iOS devices globally, particularly concerning cryptocurrency theft. Researchers continue to monitor its proliferation among financially motivated actors, and investigations are ongoing to confirm the identities of the threat actors involved.