A newer variant of a known iPhone exploit kit now targets keychain data and cryptocurrency wallets directly on the device.
The Hacker News reports that researchers at iVerify have found P7, a new variant of the DarkSword iOS exploit kit first documented in March 2026. P7 reduces its on-device footprint while adding on-device keychain and cryptocurrency wallet theft and two way command and control communication, polling for new commands roughly every 15 seconds. It supports a wallet_scan command to find installed wallet apps and a wallet_extract command that pulls data from the imToken wallet app, and unlike earlier versions, which copied the entire keychain database to attacker servers, P7 extracts keychain data into JSON on the phone itself before exfiltrating it.
Separate research from Censys found open directories exposing DarkSword and a companion kit called Coruna, including a production server that had recovered 11 victims' wallet recovery phrases, and traced one distribution path to a re-registered domain once tied to a defunct Czech analytics startup leading to a bogus crypto trading platform, pointing to a Chinese speaking threat actor. DarkSword targets iPhones running iOS 18.4 through 18.7, and Trellix recommends updating to iOS 26.3 or later, which patches all six flaws the kit uses.
Why it matters: commodity mobile exploit kits are chaining zero-days to drain on-device credential stores and crypto wallets, not just spy on messages, enterprises that issue or support iPhones should mandate current iOS versions and treat the keychain as a security boundary worth monitoring, not an afterthought.