Researchers uncover new DarkSword spyware variant affecting unpatched iPhones

Key Points:

• iVerify has identified a new variant of the DarkSword malware, named P7 DarkSword, which was found on an iPhone belonging to a financial institution employee in August 2026.
• P7 DarkSword expands compatibility to iOS 18.7 and is distributed through malicious ads in watering-hole attacks, potentially affecting users broadly rather than targeting individuals specifically.
• The new variant enhances stealth, stability, and functionality by reducing its on-device footprint, improving data theft capabilities including direct extraction of Keychain and crypto-wallet data, and enabling advanced two-way communication with attackers.
• This two-way communication allows attackers to remotely control infected devices, including retrieving files, uploading photos, accessing Apple Notes, and scanning the filesystem, with spyware checking in every 15 seconds by default.
• P7 DarkSword is not a new iOS vulnerability but an evolved malware version deployed after DarkSword compromises, rendering previous indicators of compromise ineffective and requiring updated detection methods.