Recent Discovery of P7 DarkSword Malware
iVerify has recently published a report detailing P7 DarkSword, a novel variant of malware tied to the previously identified DarkSword exploit chain targeting iPhones. The report sheds light on emerging threats to Apple devices.
Background on DarkSword Malware
Earlier this year, both Google and iVerify unearthed advanced hacking tools, namely Coruna and DarkSword. These tools leverage multiple vulnerabilities in older iOS systems to compromise devices, particularly those running outdated versions.
The DarkSword malware, once a device is compromised, allows attackers to deploy additional malicious software and extract sensitive information.
Coruna was found to target systems from iOS 13 to iOS 17.2.1, whereas DarkSword affected iPhones operating on iOS 18.4 to iOS 18.7. In response to these threats, Apple issued critical updates—including versions 15.8.7, 16.7.15, and 18.7.7—to bolster user protection against these exploits.
Noteworthy is the fact that DarkSword appeared to be employed by various commercial surveillance firms and possibly state-sponsored entities, with reported attacks occurring in nations including Saudi Arabia, Turkey, Malaysia, and Ukraine.
Detection of New Variant: P7 DarkSword
In August 2026, iVerify reported identifying a previously unrecognized variant termed P7 DarkSword, during an investigation involving an employee’s iPhone at a financial institution. This variant marks an extension of compatibility, now supporting iOS 18.7, an upgrade from its predecessor’s iOS 18.6.
According to iVerify, the dissemination of P7 occurs through malicious advertisements as part of broadly-oriented watering-hole attacks. This method implies that victims may inadvertently expose themselves to these threats while browsing compromised web pages, rather than being specifically targeted.
“In August 2026, we investigated a DarkSword infection that turned out to be a previously unseen variant, which we call P7 DarkSword. The name P7 comes from the threat actor’s use of the p7_ variable prefix in modifications to original DarkSword’s code,” iVerify reports.
The P7 variant enhances several aspects compared to previous iterations, including its stealth, stability, and operational capabilities. It features reduced on-device logging and minimizes process injections, leveraging browser storage to maintain functionality without repeatedly compromising the same devices. It also broadens its capability to steal data.
iVerify emphasized that the operational changes in P7 indicate significant efforts from the malware’s creators, moving beyond mere AI-assisted alterations. The new version exhibits improved evasion techniques and cleans its traces better than its forerunners, rendering prior indicators of compromise ineffective.
Significantly, P7 DarkSword can directly extract Keychain information on the iPhone before forwarding this data to the attackers. Moreover, it possesses the ability to target cryptocurrency wallet data and implement advanced two-way communication protocols with the attackers’ command-and-control systems.
This two-way communication feature permits the attackers enhanced control over compromised devices. iVerify notes that P7 checks in with its controlling server every 15 seconds to receive new directives, although this frequency can be modified remotely by the attackers.
Importantly, P7 does not introduce new vulnerabilities within iOS but represents an evolved form of malware derived from a successful DarkSword breach. iVerify, however, has not disclosed the iOS version present on the device where P7 was detected.
Further Reading
For those interested in a deeper technical analysis of P7 DarkSword and its operational frameworks, the full report by iVerify can be accessed here.
FTC: We use income earning auto affiliate links. More.
