P7 DarkSword iOS exploit kit adds encrypted wallet data theft and remote command capabilities

iVerify discloses a new variant of the DarkSword iOS exploit kit, P7 DarkSword, which adds on-device keychain and encrypted wallet data theft, and supports two-way C2 communication with attacker infrastructure. The implant injects into the SpringBoard process, polls for commands every 15 seconds, can execute system commands, upload photos and Apple Notes data, and targets imToken wallets for data extraction. The kit was previously used in attacks against Saudi Arabia, Turkey, Malaysia, and Ukraine, and iVerify also observed multiple suspected LLM-assisted attempts to adapt to iOS 26.x.