P7 Dark Sword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
Summary: iVerify disclosed a new DarkSword iOS exploit kit variant called P7 DarkSword that reduces its on-device footprint, extracts keychain data into JSON on the phone before exfiltration, and polls attacker infrastructure for commands every 15 seconds. The kit chains iOS vulnerabilities to escape the browser sandbox, escalate to kernel privileges, and inject a payload into SpringBoard, and has been used in attacks on Saudi Arabia, Turkey, Malaysia, and Ukraine by actors including PARS Defense and Star Blizzard.
Key Takeaway: The implant is built to pull data from more than 25 wallet apps along with SMS, contacts, photos, and saved Wi-Fi passwords, and Censys recovered 11 victim recovery phrases and 179 device loot directories from a single production server run as a Chinese-speaking exploitation-as-a-service operation.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026