Spyware that steals your iCloud Keychain passwords and crypto wallets — with no click needed, just from visiting a compromised website. Here's what DarkSword P7 does, who is at risk, and the one fix that protects you.
Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
Triggered by a viral post by Andy Diaz (Oct 17, 2026). Findings below are from iVerify's Threat Intelligence Team, reported October 8, 2026 via 9to5Mac. Technical claims are attributed to the researchers.
Update — October 22, 2026: DarkSword is now being delivered at mass scale. In research disclosed October 22 by iVerify and Report URI, the DeadTag network — attackers who bought roughly 630 expired domains that nearly 8,000 legitimate websites still load code from, through forgotten chatbot and analytics tags — is serving the Coruna and DarkSword kits to iPhone visitors of trusted sites, with 248 sites directly serving spyware and iVerify counting 135 million visits a month across spyware-capable sites. A second campaign infected a financial-institution employee's iPhone through an Instagram advertisement whose exploit code ran when the ad rendered, stealing login credentials and searching crypto wallets — no click needed in either campaign. Full breakdown and checks for phone owners and website owners: DeadTag Expired Domain Check.
DarkSword P7 is a new variant of an iPhone compromise framework. iVerify's Threat Intelligence Team found it in August 2026 while investigating an infection on the iPhone of a financial-institution employee. The name comes from the p7_ variable prefix the threat actor used when modifying the original kit.
The DarkSword family was first identified in March 2026 by Google, Lookout, and iVerify as a framework chaining six iPhone vulnerabilities. Google said it was used by multiple commercial surveillance vendors and suspected state-sponsored actors, with campaigns observed in Saudi Arabia, Turkey, Malaysia, and Ukraine.
Censys researchers also found open directories on the attackers' command servers: 11 victims' seed phrases, 179 stolen-data directories, and a Chinese-language "exploit-as-a-service" admin panel listing agents and resellers.
At risk: iPhones running iOS 18.4 through 18.7 that are unpatched. P7 expanded coverage to iOS 18.7.
The exploit chain uses two vulnerabilities that Apple has already fixed:
Apple also released iOS 18.7.7 in April 2026 to protect devices staying on the 18.x branch.
Patched devices are protected. Updating your iPhone is the fix. If your iPhone is fully up to date, this exploit chain cannot touch it — the doors it walks through are already locked. This page's advice is simple and final: check for a software update right now.
Honest caveat from the researchers: iVerify notes that previous DarkSword indicators of compromise are no longer valid — P7 is stealthier. The absence of symptoms is not proof of safety; the presence of the latest iOS is the protection.
1. Has your iPhone been updated in the last 30 days?
2. Do you restart your iPhone regularly (about once a week)?
3. Do you avoid sketchy streaming or download sites in your phone's browser?
4. Do you install crypto wallet apps only from the official App Store?
5. If an ad on a streaming site promised you free crypto, would you tap it?
DarkSword P7 is an iPhone spyware variant announced by iVerify's Threat Intelligence Team (reported October 8, 2026 via 9to5Mac). It was found in August 2026 while investigators examined the iPhone of a financial-institution employee. It processes stolen iCloud Keychain data directly on the device, targets crypto-wallet apps including imToken and 25+ other wallet apps, steals Notes and Photos, and takes orders from a remote server through 15+ commands with 15-second check-ins. The name comes from the p7_ variable prefix the threat actor used in its code.
No. It is delivered through malicious ads in watering-hole attacks — compromised websites you simply visit. The exploit chain escapes the browser sandbox, gains kernel privileges, and injects into SpringBoard, the core iOS interface process. Victims were not necessarily targeted individually; drive-by exposure through compromised web content was enough.
Only if it is unpatched. DarkSword P7's exploit chain uses two vulnerabilities that Apple already fixed: CVE-2025-24201 (WebKit out-of-bounds write, CVSS 10.0, fixed in iOS 18.3.2) and CVE-2025-31200 (Core Audio memory corruption, CVSS 9.8, fixed in iOS 18.4.1). Apple also released iOS 18.7.7 in April 2026 to protect devices staying on the 18.x branch. Patched, up-to-date iPhones are protected — updating is the fix.
Per iVerify's findings: iCloud Keychain data (processed on-device in JSON format to sort passwords at the scene), data from crypto-wallet apps (imToken plus 25+ others), Notes, and Photos. It maintains two-way communication with a command server using 15+ granular commands and heartbeats every 15 seconds. Researchers at Censys also found open directories on the attackers' servers containing 11 victims' seed phrases and 179 stolen-data directories.
The best check is the simplest one: make sure your iPhone is fully updated — patched devices are not affected by this exploit chain. Restart your phone regularly (restarts clear in-memory implants), avoid sketchy streaming and download sites in your mobile browser, install crypto wallets only from the official App Store, and watch for unexplained battery drain or data usage. iVerify notes that previous DarkSword indicators of compromise are no longer valid, because P7 is stealthier.
FEATURED — BreachHunter: BreachHunter hunts for signs of compromise on your devices — so threats like DarkSword get found, not felt.
FROM INGENIOUS AI — all 11 platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI