Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.

"Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday.

The name "P7" is a nod to the threat actor's use of the "p7_" variable prefix in changes made to the original DarkSword code.

DarkSword was first publicly documented earlier this March by Google Threat Intelligence Group (GTIG), iVerify, and Lookout, detailing its ability to target iPhones running iOS versions between iOS 18.4 and 18.7. The kit was detected in the wild in November 2025.

The toolkit is engineered to chain multiple iOS vulnerabilities to escape the browser sandbox, escalate to kernel privileges, and inject the main payload into SpringBoard, the iOS process that handles app launches and the home screen. The exploit chain is assessed to be a commercial product that somehow landed in a second-hand market, from where it was acquired by financially motivated operators and other threat actors since late 2025.

The exploit kit has been put to use in attacks targeting Saudi Arabia, Turkey, Malaysia, and Ukraine by multiple threat actors, including a Turkish commercial surveillance vendor named PARS Defense via a fake Snapchat-themed website and a Russia-aligned threat actor called Star Blizzard (aka COLDRIVER) using fake invitation lures.

In August 2026, attack surface management platform Censys detailed a campaign mounted by an unknown Chinese-speaking threat actor that involved targeting Apple iOS devices with the exploit kit, in addition to serving an Apple ID decoy sign-in page.

Source link