P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
P7 DarkSword iOS exploit kit adds crypto wallet data theft and remote commands.
A new variant of the DarkSword iOS exploit kit, dubbed P7 DarkSword, has been disclosed by researchers. This variant reduces its on-device footprint, enhances its ability to steal keychain and cryptocurrency wallet data, and establishes two-way command and control (C2) communication. The exploit kit, believed to be a commercial product, has been used by various threat actors in attacks targeting multiple countries.
AI summary of the linked source. Not reviewed by an editor. How this works
Run PARS Defense?
Get an email when a new story names PARS Defense, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe P7 DarkSword exploit kit represents a significant escalation in mobile threat sophistication, specifically engineered to exfiltrate iOS keychain data and cryptocurrency wallet credentials while maintaining a low on-device footprint to evade detection. Its commercial nature means multiple threat actors can deploy it with minimal technical expertise, dramatically broadening the attack surface. The addition of two-way C2 communication transforms compromised devices into persistent, remotely controllable assets rather than one-time data theft targets. This matters because iOS users often hold a false sense of security regarding their devices, and sensitive financial data stored in keychains and crypto wallets represents high-value, immediately monetizable targets for attackers.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — P7 DarkSword
- malware — DarkSword