P7 DarkSword Variant Brings Keychain and Crypto-Wallet Theft to iOS Exploit Kit

What happened

Researchers at iVerify have disclosed a new variant of the DarkSword iOS exploit kit, dubbed P7 DarkSword. According to the report, P7 reduces its on-device footprint compared to previously observed DarkSword variants, while adding two new capabilities: theft of on-device keychain data and crypto-wallet data, and two-way command-and-control (C2) communication with attacker infrastructure. Full technical details beyond these points have not yet been published.

Why it matters

iOS exploit kits with wallet-theft and interactive C2 capability represent an escalation from one-way data exfiltration to attacker-directed, on-device actions. A smaller on-device footprint also suggests an effort to evade mobile EDR/MTD detection and forensic recovery. Any individual or organization whose iOS devices hold cryptocurrency wallets or rely on the iOS keychain for credential storage (which is essentially all iOS users) is a potential target if infection occurs, though scope, delivery method, and actual targeting have not been detailed in the disclosure.

What defenders should watch for

• Review mobile threat defense (MTD) and EDR coverage on iOS fleets for anomalous outbound C2-style traffic patterns, especially unexpected two-way or beaconing connections from managed devices.
• Flag unusual keychain access patterns or unexpected processes querying keychain/wallet app data, where visibility exists (e.g., via MDM-reported app inventories or MTD telemetry).
• Monitor for crypto-wallet apps on managed devices and treat unexplained wallet balance changes or unauthorized transactions as a potential compromise indicator worth investigating alongside device telemetry.
• Ensure iOS devices are kept current on updates, since exploit kits of this kind typically rely on chained vulnerabilities to gain initial footing.
• Threat-hunt for any indicators of compromise iVerify publishes alongside or following this initial disclosure, as IOCs were not included in the portion of the report available at this time.

Developing story

This is net-new intelligence with limited technical detail published so far; no CVE, specific delivery vector, or confirmed victim set has been disclosed. Defenders should treat the above as directional hunting guidance and watch for follow-up reporting from iVerify. Read the original coverage at The Hacker News.