P7 DarkSword adds crypto-wallet theft and two-way C2 to the iOS exploit kit
On October 11, 2026, iVerify documents P7 DarkSword, a variant of the DarkSword iOS exploit kit that shrinks its footprint, extracts the keychain and crypto wallets directly on-device, and adds a two-way command channel. Update past iOS 18.4.1 and treat any WebKit exploit chain as a credential-theft vector, not just mobile malware.
November 2025. The DarkSword exploit kit is detected in the wild on iPhones. March 2026. Google Threat Intelligence Group, iVerify, and Lookout document it publicly. October 11, 2026. iVerify reveals a new variant, P7 DarkSword, that adds keychain and crypto-wallet theft plus a two-way command channel. Why it matters: this is no longer a surveillance implant — it is an industrialized financial-theft tool, sold on and reused by both state-aligned and criminal operators.
An exploit chain that became a commercial product
DarkSword chains multiple iOS vulnerabilities to escape the browser sandbox, escalate to kernel privileges, and inject its main payload into SpringBoard, the process that handles app launches and the home screen. The kit targets iPhones running iOS 18.4 through 18.7.
The kit’s origin is instructive. According to the researchers, the exploit chain is a commercial product that landed on a second-hand market, from which financially motivated operators and other threat actors acquired it since late 2025. The P7 variant takes its name from the p7_ variable prefix introduced in changes made to the original code.
The kit has been used against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine by multiple actors: a Turkish commercial surveillance vendor called PARS Defense through a fake Snapchat-themed site, and the Russia-aligned Star Blizzard (aka COLDRIVER) through fake invitation lures. In August 2026, Censys separately documented a campaign run by a Chinese-speaking actor, paired with a decoy Apple ID sign-in page.
What P7 changes compared with DarkSword
The P7 variant is not a cosmetic repackage: it is built to be quieter and more profitable. It removes debug logging sent over HTTP or syslog, and uses the browser’s localStorage to prevent re-exploitation. Most importantly, where earlier variants copied the keychain database and processed it on the attacker’s infrastructure, P7 extracts keychain data into JSON on the phone itself before exfiltration.
The implant injected into SpringBoard centralizes all communication with the attacker’s infrastructure. It polls for commands every 15 seconds, sends a heartbeat, the list of installed applications, the contents of the iCloud Keychain, and data from apps like Notes, Photos, and cryptocurrency wallets.
The command list makes the threat concrete. Beyond the expected primitives — ls, download, photos, disk_scan, file_upload — it includes execute_command to run OS commands (cat, mkdir, rm, memdump, whoami, and more), exec to run arbitrary JavaScript inside the implant runtime, wallet_scan and wallet_extract to target wallets including imToken, and memo_scan and photo_scan to exfiltrate notes and photos.
The distribution chain: a dead domain resurrected
The most striking part of the disclosure is the delivery channel. The same P7 DarkSword exploit has been observed distributed through a domain associated with a now-defunct Czech e-commerce analytics startup. According to Report URI, unknown actors re-registered the domain ecomtrack[.]io on September 15, 2026, after it expired, to infect sites still carrying the product’s tracking tags with malicious JavaScript.
“With the tag still sitting on online stores, it now hijacks visitors, sells them on to ad networks, and in one case, it delivers a full iOS exploit chain and spyware implant,” researcher Scott Helme said. The JavaScript includes evasion measures that detect crawlers, headless browsers, and bots, serving them empty content to hide its tracks.
One route leads to a fake cryptocurrency trading platform (chainmate[.]top) that quietly serves the DarkSword exploit chain. The implant delivered this way captures SMS, contacts, call history, voicemail, photos, Apple Health data, location history, notifications, saved Wi-Fi passwords, and files from more than 25 wallet apps. The recovered build (v24) contacts the mertio.cc server every 30 seconds.
This affair marks the criminalization of commercial surveillance. DarkSword began life as a surveillance product, much like the tools of commercial vendors. By landing on a second-hand market, it became an asset shared between states and criminals, resold through an agent/reseller model whose admin panel sits exposed on the platform analyzed by Censys. The consequence for defenders is direct: the markers once read as “state-only” — rare zero-days, complex chains, targeted surveillance — no longer protect anyone. An exploit chain that is worth money always ends up copied, repackaged, and released against softer targets. iVerify is already observing LLM-assisted attempts to port the framework to iOS 26, lowering the barrier further.
The CVEs behind the chain
Censys’s analysis of open directories on five servers revealed that the DarkSword exploit kit relies on two previously undocumented CVEs: CVE-2025-24201, an out-of-bounds write in WebKit that breaks out of the Web Content sandbox (fixed in iOS 18.3.2 and iPadOS 18.3.2), and CVE-2025-31200, a memory-corruption flaw in the Core Audio framework enabling code execution when processing an audio stream in a crafted media file (fixed in iOS 18.4.1 and iPadOS 18.4.1).
Those fixes date from spring 2025. In other words, the chain is not burning a fresh zero-day: it reuses already-patched flaws, which means a device that is up to date — past iOS 18.4.1 — is not vulnerable to this specific chain. The risk concentrates on devices stuck on intermediate versions, a point mobile teams routinely underestimate when dealing with targeted attacks.
The five identified hosts include a server serving DS-Fusion v1.0, a bundle combining DarkSword with Coruna — another iOS exploit kit documented this year against iPhones running iOS 13.0 to 17.2.1 — as well as a workspace showing the operator developing chains for iOS 26, such as for CVE-2026-31001, not covered by DarkSword or Coruna. Censys describes a Chinese-speaking “exploitation-as-a-service” platform, with an agent/reseller model exposed in its admin panel.
Coruna is the companion payload kit that runs inside the victim’s browser session once DarkSword’s exploit stages land: its wallet-harvesting modules steal crypto recovery phrases, balances, and keystore data from iOS apps. Operators run DarkSword and Coruna together against shared C2 infrastructure, which is why the two names now travel as a pair in every report.
For mobile security teams, the practical reading is stark. This chain delivers a full spyware implant through a drive-by web tag, extracts the keychain and wallets on-device, and exfiltrates over two-way command-and-control — all from flaws patched in 2025. Patching is the entire mitigation, which makes device update posture the single most effective control: an iPhone on a current iOS build simply does not run this chain. The residual risk is the long tail of unmanaged or forgotten devices that never receive updates — personal phones in BYOD programs, executive devices with deferred updates, and lab or test hardware stuck on old builds.
Verdict
If your fleet contains iPhones on iOS 18.4.1 or earlier, updating is not optional: the DarkSword chain exploits WebKit and Core Audio flaws patched since 2025, and the P7 variant adds on-device wallet theft. If you manage executives or privileged mobile accounts, add monitoring of compromised web tags to your detection stack — the ecomtrack[.]io vector shows that a full exploit chain can hide behind a forgotten analytics tag on a legitimate site. If you are assessing mobile risk for your organization, remember that the barrier of “targeted attacks reserved for nation-states” has fallen: these chains are now sold, copied, and improved — sometimes with LLM assistance — by profit-driven operators.