New iPhone spyware can hunt for crypto wallets and extract their data every 15 seconds

Researchers found a new iPhone spyware variant that can remotely extract cryptocurrency wallet data and sensitive credentials from compromised devices.

Security firm iVerify disclosed the malware, designated P7 DarkSword, on Oct. 8 after investigating an infection detected in August. The variant includes commands that specifically target cryptocurrency wallet apps and can collect passwords, photos, and personal information.

The discovery highlights an emerging risk for crypto holders who rely on mobile wallets: attackers who gain access to the underlying device could obtain sensitive information without exploiting a vulnerability in the wallet app itself.

How the spyware targets cryptocurrency wallets

According to iVerify's technical investigation, P7 includes two dedicated functions to identify and collect cryptocurrency-related information.

The first, wallet_scan, searches compromised devices for installed wallet applications, allowing attackers to identify potential targets.

The second, wallet_extract, is designed to collect data associated with imToken, a cryptocurrency wallet supporting multiple blockchain networks.

Together, the commands let attackers identify cryptocurrency users and retrieve wallet-related files after gaining access to their phones.