Cybersecurity researchers have identified a new variant of the DarkSword iOS exploit kit called P7 DarkSword, which features enhanced capabilities compared to earlier versions. The updated toolkit reduces its footprint on infected devices while adding the ability to steal cryptocurrency wallet data and keychain information. P7 DarkSword also establishes two-way communication with attackers’ servers, allowing threat actors to send and receive commands from compromised iPhones. The variant gets its name from the threat actors’ use of “p7_” variable prefixes in their modifications to the original DarkSword code.
The P7 variant can execute numerous commands on infected devices, including extracting cryptocurrency wallet data, accessing Apple Notes and Photos, stealing location history and Wi-Fi passwords, and capturing SMS messages and contacts. Researchers discovered the exploit kit being distributed through a repurposed Czech e-commerce analytics domain that delivers malicious JavaScript to online stores. Evidence suggests Chinese-speaking threat actors are operating the kit as a cryptocurrency theft service, with investigations revealing multiple open servers hosting DarkSword and related exploit components, along with victim data and cryptocurrency recovery phrases.
What to do: DarkSword relies on flaws Apple has already fixed. Update your iPhone to iOS 18.7.7 or later, or to iOS 26, in Settings > General > Software Update, and turn on automatic updates.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
