Apple iOS P7 DarkSword Exploit Kit Steals Keychain and Wallet Data via CVE-2025-24201

iVerify disclosed P7 DarkSword, a newly identified version of the iPhone exploit kit, on October 9, 2026, after investigating an infected iPhone belonging to a financial-institution employee in August. The variant has a smaller on-device footprint than versions iVerify had previously observed and adds on-device theft of Keychain and cryptocurrency-wallet data, along with two-way communication with attacker infrastructure.

Key Points

• P7 DarkSword adds new ways to steal sensitive information from iPhones, including saved credentials and cryptocurrency-wallet data.
• The kit has been used in campaigns targeting people in Saudi Arabia, Turkey, Malaysia and Ukraine, and has been associated with both commercial surveillance vendors and other threat actors.
• Researchers found the exploit kit and related tools on exposed servers, along with victim data and evidence of an operator control panel.
• Apple has released security updates for multiple iOS versions; security researchers advise installing the latest available update.

How P7 DarkSword works

iVerify said the P7 name comes from the threat actor’s use of the p7_ variable prefix in changes to the original DarkSword code. The variant reduces its footprint by removing debug logging over HTTP requests and syslog, performing fewer code injections, and using browser localStorage to avoid exploiting the same device repeatedly.

Earlier DarkSword versions copied the iOS Keychain database and sent it elsewhere for processing. P7 instead extracts Keychain data into JSON on the device before sending it out. Its implant runs inside SpringBoard, the iOS process that manages the home screen and app launches, and uses that process to communicate with attacker infrastructure.

The implant checks for commands every 15 seconds by default. It can send a heartbeat, a list of installed apps, iCloud Keychain information, and data from Apple Notes, Photos and cryptocurrency-wallet apps. The polling interval can also be changed remotely.

P7’s command set includes execute_command, which can run operating-system commands such as ls, dir, cat, mkdir, rm, echo, ps, memdump, ipconfig, netstat and whoami. Other commands include ls to list directory contents; download to retrieve a device file; photos to upload images from /var/mobile/Media/DCIM; apps to enumerate app containers and bundle IDs; and exec to run JavaScript inside the implant.

The kit can also use file_upload to scan paths recursively and upload matching files, basic_info to send device metadata, and disk_scan to scan the filesystem from / and report metadata about files, directories and symbolic links. The ios_app_data command searches app sandbox and app-group containers for requested bundle IDs and uploads selected files.

Wallet and personal-data commands include wallet_scan to look for installed wallet apps, wallet_extract to extract wallet-related data from imToken, memo_scan to upload Apple Notes databases and photo_scan to upload Apple Photos images. The sleep command changes the check-in interval, while exit stops the beacon loop and implant.

iVerify said P7 supports iOS 18.7, while an earlier DarkSword version it tracked supported only through iOS 18.6. The exploit kit chains vulnerabilities to escape the browser sandbox, gain kernel privileges and inject its main payload into SpringBoard.

Earlier DarkSword activity

Google Threat Intelligence Group (GTIG) said it had observed DarkSword since at least November 2025, when the kit was used by commercial surveillance vendors and suspected state-sponsored actors against targets in Saudi Arabia, Turkey, Malaysia and Ukraine. GTIG described the original kit as supporting iOS 18.4 through 18.7 and deploying three payload families: GHOSTBLADE, GHOSTKNIFE and GHOSTSABER.

In early November 2025, GTIG said, threat cluster UNC6748 used a Snapchat-themed site, snapshare[.]chat, to target users in Saudi Arabia. The site used obfuscated JavaScript, loaded another resource in an iframe and used a session-storage key named uid to avoid reinfecting previous victims. When a targeted user browsed with Chrome, the site used the x-safari-https protocol handler to open the page in Safari. GTIG said this indicated the actor did not then have a Chrome exploit chain, and that victims were redirected to a legitimate Snapchat site to disguise the activity.

GTIG said the initial remote-code-execution chain used CVE-2025-31277, a JavaScriptCore memory-corruption flaw, and CVE-2026-20700, a dyld Pointer Authentication Code bypass. A later chain used CVE-2025-43529, another JavaScriptCore flaw, with CVE-2026-20700, and added support for iOS 18.7. The November campaign deployed GHOSTKNIFE, a JavaScript backdoor that could steal account, message, browser and location-history data, record audio, take screenshots and download files. It used a custom binary protocol over HTTP encrypted with ECDH and AES, and could receive configuration updates from its command-and-control server.

GTIG associated DarkSword activity in Turkey in late November 2025 with Turkish commercial surveillance vendor PARS Defense. The campaign supported iOS 18.4 through 18.7 and used obfuscation and ECDH/AES encryption for exploits sent between the server and victim. GTIG observed further PARS Defense-associated activity in Malaysia in January 2026, including device-fingerprinting logic and the GHOSTSABER payload.

GTIG described GHOSTSABER as a JavaScript backdoor that communicated with its command-and-control server over HTTP or HTTPS. Its functions included device and account enumeration, file listing and theft, arbitrary JavaScript execution, changing the interval between server checks, uploading device information and signed-in accounts, listing installed apps, querying SQLite databases, uploading Photos thumbnails and app files, and listing files by path or regular-expression pattern.

The kit was also used by Russia-aligned threat actor Star Blizzard, also known as COLDRIVER, which used fake invitation lures.

GTIG also linked DarkSword to suspected Russian espionage actor UNC6353, which ran a watering-hole campaign against Ukrainian users from at least December 2025 through March 2026. Compromised Ukrainian websites fetched an initial delivery stage from static.cdncounter[.]net, which created an iframe loading index.html from the same server. The activity supported iOS 18.4 through 18.6 and deployed GHOSTBLADE, a JavaScript data-mining payload that collected and sent device data but lacked the continuous operation and additional modules of GHOSTKNIFE and GHOSTSABER. GTIG said it notified and worked with CERT-UA to mitigate the activity.

GTIG identified six vulnerabilities in its analysis of the DarkSword chain: CVE-2025-31277, used for remote code execution on iOS versions before 18.6 and patched in iOS 18.6; CVE-2025-43529, used on iOS 18.6 through 18.7 and patched in iOS 18.7.3 and iOS 26.2; and CVE-2026-20700, used as a user-mode Pointer Authentication Code bypass and patched in iOS 26.3. The chain also used CVE-2025-14174 to escape the Web Content sandbox into Safari’s GPU process, patched in iOS 18.7.3 and iOS 26.2; CVE-2025-43510 to move from the GPU process to mediaplaybackd, patched in iOS 18.7.2 and iOS 26.1; and CVE-2025-43520 to obtain physical and virtual memory read/write primitives, patched in iOS 18.7.2 and iOS 26.1.

GTIG said it reported the vulnerabilities to Apple in late 2025 and that they were patched with iOS 26.3, with most fixed earlier. It characterized DarkSword’s exploit-loading mechanisms as less robust than Coruna’s and said the kit used pure JavaScript for its exploit stages and final payloads.

Newly documented infrastructure and vulnerabilities

DarkSword was publicly documented in March 2026 by GTIG, iVerify and Lookout Threat Labs, Lookout’s mobile threat-research unit. The kit had been detected in the wild in November 2025. The exploit chain was assessed to be a commercial product that entered a second-hand market and was acquired by financially motivated operators and other threat actors starting in late 2025.

In August 2026, Censys reported a campaign by an unknown Chinese-speaking threat actor that targeted Apple iOS devices with DarkSword and served an Apple ID decoy sign-in page. Censys later identified open directories on five hosts carrying DarkSword- or Coruna-related components. The host 43.134.165[.]205 served DS-Fusion v1.0, described as a combined DarkSword and Coruna package, while 166.88.95[.]90 operated as an implant command-and-control server.

Censys said two real Chinese iOS devices, 183.154.173[.]30 and 182.239.114[.]223, polled a beacon page every three seconds for several hours on September 6, 2026. The host 23.148.212[.]237 served as an analysis workspace showing development of iOS 26 exploit chains, including one for CVE-2026-31001; Censys said those chains were not covered by DarkSword or Coruna. The host 47.102.192[.]23 served as a Coruna staging host, and 156.239.230[.]120 exposed a command-and-control platform and was observed polling a device on September 15, 2026.

A copy of the production server contained 11 victim recovery phrases, 179 directories of device data and a 75-account control-plane roster, according to Censys. Censys researcher Aidan Holland described the system this way:

“The platform runs a Chinese-speaking exploitation-as-a-service operation. The admin panel exposes an agent/reseller model…”

Aidan Holland, Censys

Censys also identified a separate China-based operator using the kit in the wild against its own command-and-control server, 66ds[.]lol, and targeting BitKeep, a wallet not found in the exposed-directory set. Censys tied the operator’s infrastructure, which used Tencent and Shenyang hosting, to the operation through a unique self-signed certificate authority. The identities behind the exposed-directory cluster and command-and-control platform remained unknown.

Analysis of the production server’s exploit registry identified two CVE identifiers that had not previously been documented as part of DarkSword. CVE-2025-24201 is an out-of-bounds write in WebKit that could let an attacker escape the Web Content sandbox; it was fixed in iOS 18.3.2 and iPadOS 18.3.2. CVE-2025-31200 is a Core Audio memory-corruption vulnerability that could allow code execution when processing an audio stream in a maliciously crafted media file; it was fixed in iOS 18.4.1 and iPadOS 18.4.1.

Hijacked Website Spreads DarkSword Spyware

Report URI said unknown actors re-registered the expired domain ecomtrack[.]io on September 15, 2026. The domain had been associated with ecomtrack s.r.o., a defunct Czech e-commerce analytics startup operating as Ecomtrack. Malicious JavaScript used tracking tags that remained on some websites to target visitors. It used cloaking to show empty content to crawlers, headless browsers and bots, collected device and browser information, sent it to an external server and redirected visitors to a scam site or online casino.

One route led to the purported cryptocurrency trading platform chainmate[.]top, which served the DarkSword exploit chain. The delivered implant was designed to collect SMS messages, contacts, call history, voicemail, photos, Apple Health data, location history, notifications, saved Wi-Fi passwords and files from more than 25 wallet apps. Report URI and security researcher Scott Helme said:

“With the tag still sitting on online stores, it now hijacks visitors, sells them on to ad networks, and in one case, it delivers a full iOS exploit chain and spyware implant.”

Scott Helme, Report URI

Helme said the recovered code contacted mertio.cc every 30 seconds, handled commands including exec, download, photos and spy, and appeared to be a newer v24 build reporting to different infrastructure and targeting more cryptocurrency wallets. This recovered code’s 30-second check-in interval is distinct from P7’s default 15-second polling interval.

iVerify said it had occasionally seen DarkSword and Coruna bundled together, a combination it called DarkCoruna. It said the Coruna source appeared to have been obtained and modified, with substantial code changes compiled into new binaries rather than made through binary patching. Many bundled variants did not work, and iVerify said it had no evidence that attackers without Coruna’s source had reverse-engineered and reimplemented it using large language models.

iVerify also observed multiple unsuccessful attempts, likely assisted by large language models, to update the framework for iOS 26.x. It attributed those attempts to the exploit-kit leak shortly after public disclosure and said the variants focused on stability, stealth and the quality of stolen data.

Apple has released updates for older operating systems, including iOS 15.8.7, iOS 16.7.15 and iOS 18.7.7. iOS 18.7.7 was made available even for devices capable of installing iOS 26, to protect users who had not upgraded. GTIG urged users to install the latest iOS version and recommended Lockdown Mode when updating was not possible; users should also install the latest available patches for older iOS versions and exercise caution with suspicious advertisements, unfamiliar sites and webpages that may have been compromised.