DarkSword iOS exploit variant steals cryptocurrency wallets

Security firm iVerify has released technical details regarding P7 DarkSword, a new variant of an iOS exploit kit that adds bidirectional communication and digital asset theft capabilities. The tool infects devices running versions between iOS 18.4 and iOS 18.7 to extract system keychain credentials and data stored in cryptocurrency applications.

The DarkSword kit was first documented in March 2026 by Google Threat Intelligence Group, iVerify, and Lookout, following recorded real-world activity against devices in November 2025. According to forensic analysis, the original development emerged as commercial surveillance software that was eventually leaked on secondary markets, where it has been adopted by financially motivated actors and state-backed espionage groups.

Technical mechanisms and local data extraction

P7 DarkSword chains system flaws to bypass web browser isolation, escalate privileges to the operating system kernel, and inject its code into SpringBoard, the core iOS process responsible for the home screen and application launching. According to the iVerify report, this version uses the p7_ prefix in its internal variables, suppresses debug logs in HTTP requests, and stores data in the browser to avoid executing the exploit more than once on the same device.

Unlike previous versions that sent the entire keychain database for remote analysis, the P7 variant processes and formats keys into a JSON file on the phone itself before transmitting it to command servers. The implant queries for instructions every 15 seconds, during which it transmits the phone's status, the list of installed programs, Apple Notes logs, photos, and contents from wallets such as imToken.

The vulnerability record documented by Censys details that the chain relies on two specific flaws: CVE-2025-24201, a write overflow in the WebKit browsing engine patched in iOS 18.3.2, and CVE-2025-31200, a memory corruption issue in the Core Audio framework patched in iOS 18.4.1 that allows for arbitrary instruction execution via manipulated sound sequences.

Distribution via expired domains

Security researcher Scott Helme, via Report URI, documented that unidentified attackers reactivated the domain ecomtrack.io on September 15, 2026, after the registration for the Czech startup managing it expired. The domain maintained active tracking tags on various e-commerce stores, which allowed for the insertion of malicious code into legitimate webpages to redirect shoppers.

The malicious code analyzes browser characteristics to block automated analysis tools and sends visitors to fraudulent platforms like chainmate.top, a fake cryptocurrency trading portal that delivers the DarkSword exploit chain. Helme noted that this implementation, cataloged as version 24, communicates every 30 seconds with the server mertio.cc and collects call histories, SMS messages, Wi-Fi passwords, and files from over 25 cryptocurrency custody applications.

Commercialization and operators on open infrastructure

Censys identified five servers with open directories containing DarkSword components combined with Coruna, another exploit set designed to compromise versions from iOS 13.0 to iOS 17.2.1. The combined package, dubbed DS-Fusion v1.0, allows attackers to extract balances, keystore passwords, and seed phrases intended for recovering funds in mobile wallets.

Aidan Holland, a researcher at Censys, indicated that one of the administrative panels linked to the address 156.239.230.120 operated under a Chinese-language exploit-as-a-service model structured for resellers. The server copy allowed for the recovery of 11 cryptocurrency recovery phrases belonging to victims, 179 folders with exfiltrated information, and a management log with 75 associated control accounts.

Infrastructure analysis also revealed failed attempts to update the tools toward experimental versions of iOS 26 using large language models, in addition to previous deployments linked to the Turkish firm PARS Defense and the Russian group Star Blizzard in countries such as Ukraine, Turkey, Malaysia, and Saudi Arabia.

Monitoring the ecosystem requires ensuring the urgent update of vulnerable devices on intermediate versions of iOS 18 and monitoring deprecated web dependencies that continue to load resources from expired domains.