[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsPxAEZiTQEHJogNNiHtZppvWria9FcezFPiX1HGemcw":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"be9964da-7614-4bdf-83b5-00931f2873df","P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands","p7-darksword-ios-exploit-kit-adds-crypto-wallet-data-theft-and-remote-commands-2d8b2a","Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. \"Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure,\" iVerify said in a new report published Thursday. The name","A new variant of the DarkSword iOS exploit kit, dubbed P7 DarkSword, has been disclosed by researchers. This variant reduces its on-device footprint, enhances its ability to steal keychain and cryptocurrency wallet data, and establishes two-way command and control (C2) communication. The exploit kit, believed to be a commercial product, has been used by various threat actors in attacks targeting multiple countries.","P7 DarkSword iOS exploit kit adds crypto wallet data theft and remote commands.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fp7-darksword-ios-exploit-kit-adds.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiT-SCb1qpP1Z0zyo_WOtyHzQKUiqJ3RudpC9uowSePmGcLZ9sPHcE-lvDGMZTHeB7YckgDmaBA775L13GvrYHl_gAVSg46-5sUJWzcA7Q3ec5h8WIuKO5l0Td2CCk5nlSvNByqPL22qlTNwHms3rbdXsJYoEe7gRqHiqmM8DHtvEkKniOP4Q70Dq_5Dr8I\u002Fs1600\u002Fios.jpg","2026-10-09T16:29:55+00:00","2026-10-09T18:00:29.688683+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"Star Blizzard","threat_actor",{"name":21,"type":19},"COLDRIVER",{"name":23,"type":24},"PARS Defense","vendor",{"name":26,"type":27},"P7 DarkSword","product",{"name":29,"type":27},"DarkSword","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,51],{"type":34,"value":26,"context":50},"New variant of the DarkSword iOS exploit kit",{"type":34,"value":29,"context":52},"Original iOS exploit kit",[23,26,29],{"controls":55,"vendors":139},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":86,"name":87,"problem":88,"products":89},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":47,"name":115,"problem":116,"products":117},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[118,126,131],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":127,"product_name":128,"url":129,"description":130},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[140,146],{"slug":141,"name":142,"logo_path":143,"roles":144},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[145],"affected",{"slug":147,"name":148,"logo_path":149,"roles":150},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":167},"p7-darksword-ios-exploit-kit-targets-crypto-wallets-and-keychain-data","P7 DarkSword iOS Exploit Kit Targets Crypto Wallets and Keychain Data","The P7 DarkSword exploit kit represents a significant escalation in mobile threat sophistication, specifically engineered to exfiltrate iOS keychain data and cryptocurrency wallet credentials while maintaining a low on-device footprint to evade detection. Its commercial nature means multiple threat actors can deploy it with minimal technical expertise, dramatically broadening the attack surface. The addition of two-way C2 communication transforms compromised devices into persistent, remotely controllable assets rather than one-time data theft targets. This matters because iOS users often hold a false sense of security regarding their devices, and sensitive financial data stored in keychains and crypto wallets represents high-value, immediately monetizable targets for attackers.",[157,158,159,160,161,162,163,164,165,166],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices","NIST CSF DE.CM-1: Network communications are monitored","NIST PR.DS-1: Data-at-rest is protected","NIST PR.DS-2: Data-in-transit is protected","GDPR Article 32: Security of processing (for organizations handling EU personal data on mobile devices)","MITRE ATT&CK Mobile T1414: Capture SMS Messages \u002F Keychain Access","MITRE ATT&CK Mobile T1437: Standard Application Layer Protocol (C2)",{}]