New P7 DarkSword spyware threatens unpatched iPhones and crypto wallets

The emergence of P7 DarkSword, a more sophisticated variant of the spyware linked to earlier iPhone attacks, suggests that cybercriminals are continuing to develop their tools even after Apple has released security patches.

The new malware is designed to operate more discreetly, steal sensitive information and give attackers greater remote control over compromised devices.

More concerningly, P7 DarkSword can spread through malicious advertisements, potentially exposing users who are not specifically targeted by the attackers.

New DarkSword variant puts unpatched iPhones at risk

In a report published on October 9, cybersecurity company iVerify disclosed the discovery of P7 DarkSword, a previously undocumented malware variant associated with the DarkSword iPhone exploit chain.

The discovery followed an investigation into an infected iPhone belonging to an employee at a financial institution in August 2026.

Earlier this year, Google and iVerify revealed two sophisticated iPhone hacking toolkits, Coruna and DarkSword.

Both exploit chains combine multiple vulnerabilities in Apple's iOS operating system to compromise devices running outdated software.

Coruna targeted devices running iOS 13 through iOS 17.2.1, while DarkSword affected iPhones running iOS 18.4 through iOS 18.7.