DarkSword iOS exploit kit new variant P7 exposed
Start here
iVerify discloses a new variant of the DarkSword iOS exploit kit, P7 DarkSword, which adds on-device keychain and encrypted wallet data theft and supports bidirectional C2 communication with attacker infrastructure. The implant injects into the SpringBoard process, polls for commands every 15 seconds, can execute system commands, upload photos and Apple Notes data, and targets imToken wallets for data extraction. The kit has previously been used in attacks against Saudi Arabia, Turkey, Malaysia, and Ukraine.
Generated by AI from reports · Updated 3 days ago
Progress timeline
- The Hacker NewsP7 DarkSword iOS 漏洞利用套件新增加密钱包数据窃取与远程命令功能
iVerify 披露 DarkSword iOS 漏洞利用套件的新变种 P7 DarkSword，新增设备端钥匙串与加密钱包数据窃取，并支持与攻击者基础设施的双向 C2 通信。该植入体注入 SpringBoard 进程，每 15 秒轮询命令，可执行系统命令、上传照片与 Apple Notes 数据，并针对 imToken 钱包提取数据。该套件此前被用于针对沙特阿拉伯、土耳其、马来西亚和乌克兰的攻击，iVerify 还观察到多次疑似 LLM 辅助的 iOS 26.x 适配尝试。
Related discussion
- Older than 72 hours · Not included in the 72-hour figures
- 网页IT之家iPhone 间谍软件 P7 DarkSword 曝光：每 15 秒通信外传照片等用户数据(opens the original post in a new tab)
Attention trend
New sources per day
- Oct 9New1 sources (1 outlets,0 accounts)
- Oct 10New1 sources (1 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)