Cybersecurity researchers have reported the identification of a new variant of the DarkSword spyware named P7 DarkSword that can steal sensitive information from vulnerable iPhones.
According to ITna citing 9to5mac, this malware, identified by security firm iVerify, has more advanced capabilities to hide from security tools, steal data, and communicate with attackers' infrastructure. For this reason, users whose iPhones run vulnerable iOS versions should pay special attention to installing security updates.
Previously, Google and iVerify had introduced two sophisticated iPhone hacking tools called Coruna and DarkSword. These tools, by exploiting a chain of software vulnerabilities, could infect devices running older operating system versions. Coruna targeted iOS versions 13 through 17.2.1 and DarkSword targeted versions 18.4 through 18.7.
After these threats were identified, Apple released several security updates including iOS 15.8.7, 16.7.15 and 18.7.7. The company even made version 18.7.7 available for some devices that could install iOS 26 so that users who had not upgraded their operating system would still receive security protection.
iVerify stated that the new P7 variant was discovered during the investigation of an iPhone infection of an employee of a financial institution in August 2026. This variant is compatible with iOS 18.7 and, compared with previous samples, leaves fewer traces on the device. It has also added the ability to steal Keychain data and cryptocurrency wallets to its capabilities.
One propagation method for this spyware is the use of malicious advertisements and attacks known as "Watering-hole Attack." In this method, attackers infect websites or online content visited by users; therefore, victims are not necessarily chosen individually and may be exposed during their normal internet activity.
The new variant also supports two-way communication with the attackers' command-and-control server. This capability allows attackers to send new commands and extract specific information from the infected device; including files, images, the list of installed apps, Apple Notes app data, and information stored in app-specific containers. By default, the spyware contacts the attackers' server every 15 seconds to receive new commands.
Researchers emphasize that P7 is not a new iOS vulnerability, but rather a new version of malware that runs on the device after a successful DarkSword attack. Therefore, installing the security patches released for vulnerable versions is one of the most important defensive measures for users.