P7 DarkSword iOS exploit kit adds crypto wallet theft and remote commands

· Cybersecurity

Cybersecurity researchers disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. Compared with the variants usually observed, the new version reduces its on-device footprint while adding on-device keychain and crypto-wallet theft, along with two-way command-and-control communication with the attacker's infrastructure. The changes point to a more capable and stealthier tool aimed at extracting high-value credentials and digital assets from compromised iPhones. The variant's ability to maintain two-way C2 means operators can issue new instructions after initial infection rather than simply exfiltrating data once. For defenders, the emergence of an upgraded iOS exploit kit underlines that mobile devices remain a target and that post-infection detection, not just prevention, matters on iOS.

Why it matters：Mobile exploit kits that steal crypto wallets and retain remote control represent an escalation in financially motivated attacks on iOS, an area where monitoring has traditionally been thinner than on desktop.

Key points

  • P7 DarkSword is a previously unseen DarkSword iOS exploit kit variant.
  • It adds on-device keychain and crypto-wallet theft.
  • It adds two-way command-and-control communication and reduces its on-device footprint.

Sources (original reporting)

More stories from this day