A new version of the DarkSword iPhone spyware is out in the wild, and it hides better and steals more than the builds researchers saw before. It pulls Keychain data and crypto wallet files straight off the phone, and its operators can steer it remotely.
Security firm iVerify published the full technical write-up as reported by 9to5Mac. It calls the variant P7 DarkSword, after a p7_ variable prefix the operators left in their modified code. The firm found it in August while investigating an infection on a customer’s device.
The report does not say which iOS version the infected device was running. The exploit modules hosted for P7 cover iOS 18.4 through iOS 18.7, which puts iPhones on iOS 18 without the latest patches in range.
P7 DarkSword Pulls Keychain Data Directly on the iPhone
Earlier DarkSword versions copied the entire Keychain database and sent it to the attackers’ servers for processing. P7 extracts the Keychain items into a JSON file on the phone and uploads that instead. Less data leaves the device, and the footprint stays smaller.
The implant runs inside SpringBoard, the process that manages the Home Screen. It checks in with the attackers’ server every 15 seconds for new instructions, and the operators can change that interval remotely with a sleep command.
Through that connection the operators control a wide command set. It lets them:
- Download any file from the phone, including photos stored on it
- List installed apps and pull data from individual app containers
- Copy the Apple Notes databases
- Scan the whole filesystem and upload a report of what it finds
- Check for crypto wallet apps and extract data from the imToken wallet app
- Run arbitrary JavaScript inside the implant
P7 is also quieter than its predecessors because it drops debug logging over HTTP and syslog, cuts the number of process injections, and sets a flag in browser localStorage so the same phone is not exploited twice. Together those changes make it harder to spot and less likely to destabilize the device.
iVerify notes that many DarkSword variants it tracks look AI-assisted. The P7 authors understood the code they were editing, trimming the implant’s footprint while adding new theft features. DarkSword code has also reached the jailbreak scene, where Dopamine 3.0 added the ClearSword exploit, which its developers describe as a cleaner alternative.
Apple Shipped DarkSword Fixes in 2025 and Widened iOS 18.7.7 in April
The iOS 18.7.7 security notes state that the DarkSword-related fixes first shipped in 2025. They also state that iOS 18.7.7 became available to more devices on April 1, 2026, so iPhones with Automatic Updates turned on could receive protection from the web attacks automatically.
iVerify does not name a specific patch that stops P7, so the safe move is to run the newest build available for your model. iPhone 11 and later can run iOS 27, and the current release is iOS 27.0.1, which arrived on September 28, 2026. The same day brought iOS 26.7.1 for iPhone 11 and later.
iPhone XS, iPhone XS Max and iPhone XR cannot run iOS 26 or iOS 27. Their latest build is iOS 18.7.10, released on August 17, 2026. Plenty of people stay on older software, and iOS 26 adoption has trailed iOS 18, so a sizable group of iPhones still sits on the iOS 18 line that P7 targets. The exploit modules reach as far as iOS 18.7, released in September 2025.
To check, open Settings, tap General, then Software Update, and switch on Automatic Updates while you are there.
