New P7 DarkSword iOS Kit Targets Crypto Wallets

On Thursday, cybersecurity researchers iVerify released details about a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. Compared with variants usually observed, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and supports two‑way C2 communication with attacker infrastructure.¹

The kit’s keychain access mechanism likely leverages a vulnerability in Apple’s certificate management system that lets attackers impersonate trusted applications—a flaw similar to rogue MDM profile attacks seen since 2018 targeting enterprise devices.¹

P7’s focus on crypto wallets ties directly to Bitcoin price increases ($65k/BTC as of October 3rd), suggesting an economic motivation for high-value targets.¹

Its reduced footprint indicates sophisticated evasion techniques designed around updates to Apple Mobile Device Support Program released earlier this year, allowing malware to slip past standard detection methods.¹

The exploit kit also exploits vulnerabilities in Apple’s sandboxing mechanisms, enabling it to read keychain data—including stored passwords, credit card information, and cryptographic keys used by crypto wallets—while remaining undetected during initial infection phases.¹

Similar kits such as Predator have stolen private keys since 2024; the difference here is the added ability to steal wallet data alongside remote command execution capabilities, indicating targeted attacks against high-value individuals or organizations are likely.¹

For iOS users who rely on keychain for secure storage, P7 DarkSword raises serious concerns: attackers can exfiltrate sensitive credentials and issue arbitrary commands remotely, potentially compromising device integrity and user privacy.¹

Security teams should update defenses against reduced-footprint malware and monitor for unauthorized certificate usage, while anticipating more variants with similar functionality as mobile device security continues to lag behind desktop defenses.¹