OP 11 October, 2026 - 09:01 PM
Cybersecurity researchers have revealed details about a previously unknown variant of the 'DarkSword' exploit kit for iOS, dubbed 'P7 DarkSword.'
"Compared to the variants we typically see, the P7 reduces its footprint on the device, adds key theft and crypto-wallet features, and enables two-way communication between C2 and the attacker's infrastructure," iVerify said in a new report released on Thursday.
The name "P7" is a reference to the attacker's use of the "p7_" prefix for variables when making changes to the DarkSword source code.
DarkSword was first publicly reported in early March this year by the Google Threat Intelligence Group (GTIG), iVerify, and Lookout, detailing its ability to attack iPhones with iOS versions 18.4 to 18.7. This set was discovered in a real-world environment in November 2025.
This toolkit is designed to sequentially exploit multiple iOS vulnerabilities in order to go beyond the browser sandbox, escalate privileges to the kernel level, and inject a core payload into SpringBoard, the iOS process responsible for launching applications and running the home screen. This exploit chain is believed to be a commercial product that somehow made its way to the second-hand market, from where it has been purchased by financially motivated attackers and other cyberthreat actors since late 2025.
This exploit kit has been used in attacks targeting Saudi Arabia, Turkey, Malaysia, and Ukraine by a variety of threat actors, including Turkish commercial video surveillance solution provider PARS Defense, which used a fake website that mimicked the Snapchat app, as well as a Russian-linked threat actor called Star Blizzard (aka COLDRIVER), who resorted to fake invitations as bait.
In August 2026, attack surface management platform Censys detailed a campaign organized by an unknown Chinese-speaking threat actor that used an exploit kit to attack Apple iOS devices and exploit a fake Apple ID login page.
, which recorded "several failed attempts, probably using the LLM, to update the platform to support iOS 26.x," which were triggered by the leak of the exploit kit shortly after its public disclosure. These options, as the mobile security company added, focus on stability, secrecy, and the quality of the stolen data.
P7 DarkSword represents an evolution in these aspects, as it eliminates debugging logging via HTTP requests and syslog, and uses the browser's local storage (localStorage) to prevent the vulnerability from being reexploited. Unlike the previous versions, which copied and output the key database for processing on the attacker's infrastructure, the new version extracts key data in JSON format directly on the phone before it is displayed.
"The implant is embedded in the SpringBoard process, which handles all communication with the attacker's infrastructure," iVerify said.
The latest version is capable of polling commands every 15 seconds, sending a "heartbeat" message, transmitting a list of installed apps, as well as information from iCloud Keychain and data from apps like Apple Notes, Photos, and cryptocurrency wallets.
The response to the periodic task request contains commands that must be executed on the victim's phone. This includes:
"Compared to the variants we typically see, the P7 reduces its footprint on the device, adds key theft and crypto-wallet features, and enables two-way communication between C2 and the attacker's infrastructure," iVerify said in a new report released on Thursday.
The name "P7" is a reference to the attacker's use of the "p7_" prefix for variables when making changes to the DarkSword source code.
DarkSword was first publicly reported in early March this year by the Google Threat Intelligence Group (GTIG), iVerify, and Lookout, detailing its ability to attack iPhones with iOS versions 18.4 to 18.7. This set was discovered in a real-world environment in November 2025.
This toolkit is designed to sequentially exploit multiple iOS vulnerabilities in order to go beyond the browser sandbox, escalate privileges to the kernel level, and inject a core payload into SpringBoard, the iOS process responsible for launching applications and running the home screen. This exploit chain is believed to be a commercial product that somehow made its way to the second-hand market, from where it has been purchased by financially motivated attackers and other cyberthreat actors since late 2025.
This exploit kit has been used in attacks targeting Saudi Arabia, Turkey, Malaysia, and Ukraine by a variety of threat actors, including Turkish commercial video surveillance solution provider PARS Defense, which used a fake website that mimicked the Snapchat app, as well as a Russian-linked threat actor called Star Blizzard (aka COLDRIVER), who resorted to fake invitations as bait.
In August 2026, attack surface management platform Censys detailed a campaign organized by an unknown Chinese-speaking threat actor that used an exploit kit to attack Apple iOS devices and exploit a fake Apple ID login page.
, which recorded "several failed attempts, probably using the LLM, to update the platform to support iOS 26.x," which were triggered by the leak of the exploit kit shortly after its public disclosure. These options, as the mobile security company added, focus on stability, secrecy, and the quality of the stolen data.
P7 DarkSword represents an evolution in these aspects, as it eliminates debugging logging via HTTP requests and syslog, and uses the browser's local storage (localStorage) to prevent the vulnerability from being reexploited. Unlike the previous versions, which copied and output the key database for processing on the attacker's infrastructure, the new version extracts key data in JSON format directly on the phone before it is displayed.
"The implant is embedded in the SpringBoard process, which handles all communication with the attacker's infrastructure," iVerify said.
The latest version is capable of polling commands every 15 seconds, sending a "heartbeat" message, transmitting a list of installed apps, as well as information from iCloud Keychain and data from apps like Apple Notes, Photos, and cryptocurrency wallets.
The response to the periodic task request contains commands that must be executed on the victim's phone. This includes:
- execute_command — to execute operating system commands such as ls, dir, cat, mkdir, rm, echo, ps, memdump, ipconfig, netstat, whoami, and others.
- ls — to list the contents of the directory.
- download — to read a file from the device and send it to the C2 server.
- photos — to send photo files from the "/var/mobile/Media/DCIM" directory.
- apps—To enumerate app containers and extract package IDs.
- exec — to execute arbitrary JavaScript code directly in the implant runtime.
- file_upload - To recursively scan one or more paths and download the corresponding files.
- basic_info - To send device metadata to the C2 server.
- disk_scan — for recursively scanning the file system, starting with "/", recording metadata of files, directories and symbolic links, and sending information in the form of a report.
- ios_app_data - To search for application sandbox containers and application groups by requested package IDs and upload selected application files.
- wallet_scan — to scan installed wallet applications.
- wallet_extract - To extract wallet-related data for the imToken app.
- memo_scan — to download Apple Notes databases.
- photo_scan — to upload photos from Apple Photos.
- sleep — to change the beacon polling interval.
- exit - to stop the beacon polling loop and terminate the implant.
The information comes after Censys reported that it had discovered open directories on five hosts containing components associated with DarkSword and Coruna, another iOS exploit kit discovered earlier this year and used in attacks targeting iPhone models with iOS versions 13.0 to 17.2.1.
"Coruna is a companion set of malicious modules distributed within the same ecosystem," Censys said. "Its modules run in the victim's browser session after the DarkSword exploits are launched, and its modules designed to steal wallet data steal cryptocurrency recovery phrases, account balances, and keystore data from iOS apps. The attackers are running DarkSword and Coruna at the same time, using their own C2 infrastructure."
Below is a list of five hosts:
"Coruna is a companion set of malicious modules distributed within the same ecosystem," Censys said. "Its modules run in the victim's browser session after the DarkSword exploits are launched, and its modules designed to steal wallet data steal cryptocurrency recovery phrases, account balances, and keystore data from iOS apps. The attackers are running DarkSword and Coruna at the same time, using their own C2 infrastructure."
Below is a list of five hosts:
- 43.134.165[.]205, which hosts DS-Fusion v1.0 (also known as DarkSword Fusion), is a combo package that includes both DarkSword and Coruna in a single distribution.
- 166.88.95[.]90, which works as the implant's C2 server and has captured two real Chinese iOS devices (183.154.173[.]30 and 182.239.114[.]223), who polled the beacon page every three seconds for several hours on September 6, 2026.
- 23.148.212[.]237 – serves as a working environment for analysis, where you can see how the operator is developing exploit chains for iOS 26 (e.g. CVE-2026-31001), which are not covered by either DarkSword or Coruna.
- 47.102.192[.]23, which serves as an intermediate host for the Coruna set.
- 156.239.230[.]120, which discloses the entire C2 platform and was seen polling the device on September 15, 2026.
Analysis of the vulnerability registry on the production server showed that the DarkSword exploit kit contains two previously undocumented CVE identifiers:
- CVE-2025-24201 is an out-of-range write vulnerability in the WebKit engine that could allow an attacker to escape the web content sandbox (fixed in iOS 18.3.2 and iPadOS 18.3.2)
- CVE-2025-31200 is a memory corruption vulnerability in the Core Audio framework that allows code execution when processing an audio stream in a specially forged media file (fixed in iOS 18.4.1 and iPadOS 18.4.1)
It is assumed that the open-directory cluster and platform are 156.239.230[.]120 are operated by a Chinese-speaking threat actor with the aim of stealing cryptocurrency wallets. At the same time, it is not known exactly who is behind this.
"The platform manages a Chinese-language Exploitation-as-a-Service operation," said Censys researcher Aidan Holland. "The administrative panel demonstrates the agent/reseller model, and on the copy of the production server, 11 recovery phrases of the victims, 179 directories with data stolen from devices, and a list of 75 accounts in the control plane were found."
Censys also said it had found a separate operator from China using the same toolkit in a real-world environment against its own C2 server at "66ds[.]lol", while he included a new cryptocurrency wallet (BitKeep) in the list of targets, which was not in the set of open directories. This data once again underscores the widespread adoption of this toolkit among cybercriminals with financial goals.
"The operator behind this project uses Tencent and Shenyang hosting linked to it through a unique self-signed certificate authority," Censys said.
source : https://thehackernews.com/2026/10/p7-dar...-adds.html
"The platform manages a Chinese-language Exploitation-as-a-Service operation," said Censys researcher Aidan Holland. "The administrative panel demonstrates the agent/reseller model, and on the copy of the production server, 11 recovery phrases of the victims, 179 directories with data stolen from devices, and a list of 75 accounts in the control plane were found."
Censys also said it had found a separate operator from China using the same toolkit in a real-world environment against its own C2 server at "66ds[.]lol", while he included a new cryptocurrency wallet (BitKeep) in the list of targets, which was not in the set of open directories. This data once again underscores the widespread adoption of this toolkit among cybercriminals with financial goals.
"The operator behind this project uses Tencent and Shenyang hosting linked to it through a unique self-signed certificate authority," Censys said.
source : https://thehackernews.com/2026/10/p7-dar...-adds.html
![[Image: Pn2slWO.jpeg]](https://i.imgur.com/Pn2slWO.jpeg)
LIFETIME
