Back www.iverify.com

Darksword Variant Threat Research

www.iverify.com • October 17, 2026

In August 2026 we investigated a DarkSword infection that turned out to be a previously unseen variant, which we call P7 DarkSword. The name P7 comes from the threat actor’s use of the p7_ variable prefix in modifications to original DarkSword’s code. Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure. This post describes the investigation, the variant's capabilities, and the indicators that can be used to detect it.

In August 2026, we received an alert a DarkSword infection on one of our customers' devices. The detection differed slightly from the usual DarkSword detections we observe. With the customer's consent, we began the incident response process and obtained additional forensic artifacts, which confirmed that this was an unknown DarkSword variant. Around the time of the infection, we also observed additional suspicious files being created in the /private/var/tmp directory. We continued the investigation to answer the customer's specific questions and to recover a spyware sample.

In parallel, we used the Validin platform to hunt for Coruna and DarkSword variants in the wild, with custom tooling to automatically fetch all exploit and implant content from the results. While the forensic investigation was still underway, we isolated this variant in the Validin results using known filesystem artifacts from the infected phone. Shortly afterward, we extracted a suspicious domain matching the suspected infection timeline; the content hosted there appeared to be a different version of the same spyware family. By analyzing this version's code, we determined that unlike many of the AI-assisted variants we have observed, its authors had invested real effort in modifying it, and their changes demonstrated competence.

P7 DarkSword improves on earlier variants in three areas:

Stealth. It eliminates debug logging over HTTP requests and syslog, and reduces the number of process injections.

Stability. It uses browser localStorage to prevent re-exploitation.

Functionality. It extracts keychain data into JSON on the phone for exfiltration ( DarkSword versions copied and exfiltrated the keychain database to process on the attacker's infrastructure) and supports advanced two-way C2 communication.

The implant is injected into the SpringBoard process, which handles all communication with the attacker's infrastructure.

The core of the C2 communication is the /beacon request, sent every 15 seconds (the interval is configurable from the C2 via the sleep command). The response contains commands to execute on the victim's phone.

In addition to the generic execute_command dispatcher, which accepts shell-style subcommands, the implant implements dedicated command handlers:

Indicators of compromise

hxxps://cdn[.]gotoiphone[.]com

hxxps://mzpo30[.]cam/assets/js/group[.]html

hxxps://js[.]gotoiphone[.]com/ios18

All requests are POST over HTTP/1.0 with a hardcoded User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1 . Content-Type boundary=------HqBound for endpoint /p is also a hardcoded value. The attackers leverage HTTPS, but without strict certificate validation.

sha256 hashes of exploit components:

sha256 hashes of extracted implant components:

Browser localStorage:

Unique file system artifacts:

P7 DarkSword shows that DarkSword operators are actively iterating on the implant. Unlike the many AI-assisted variants we observe, the P7 authors understood the code they were modifying: their changes reduced the implant's footprint while extending its theft capabilities. Incident response processes and forensic investigation for partial or heuristic detections can result in new discoveries and improved detection.

Please find indicators of compromise for other Coruna and DarkSword variants below:

DarkSword Domains (iframe host : darksword host) - self means same origin

DarkSword hashes - rce_loader.js

5 Mobile Security Myths That Leave Enterprises Exposed

Coruna, DarkSword and the Enterprise iPhone: Key Takeaways from Packet Protector

WeWorm(s) Armageddon: Mobile Edition

5 Mobile Security Myths That Leave Enterprises Exposed

Coruna, DarkSword and the Enterprise iPhone: Key Takeaways from Packet Protector

WeWorm(s) Armageddon: Mobile Edition

Proliferation of Coruna and DarkSword

5 Mobile Security Myths That Leave Enterprises Exposed

Coruna, DarkSword and the Enterprise iPhone: Key Takeaways from Packet Protector

WeWorm(s) Armageddon: Mobile Edition

Get Our Latest Blog Posts Delivered Straight to Your Inbox

at the Advanced Mobile Security Summit, Nov 10th. Apply to attend

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

P7 DarkSword Malware Targets iPhones for Crypto Wallet Theft Researchers have identified a new variant of the DarkSword malware, named P7 DarkSword, which targets unpatched iPhones to steal sensitive information, including cryptocurrency wallet data. Discovered by iVerify, the malware was found on a financial institution employee's device in August 2026. P7 DarkSword enhances its stealth capabilities by reducing activity logs and directly extracting Keychain data on the device. It communicates with its command-and-control server every 15 seconds to receive instructions, allowing it to upload files, access photos, and scan for installed apps. The malware exploits vulnerabilities in iOS versions 18.4 to 18.7, and Apple has issued updates to protect users. P7 DarkSword is distributed through malicious ads and watering-hole attacks, posing a significant risk to users who delay updates. The exact number of affected devices remains unclear. 24 sources 68

Extracted Entities

Darksword Variant Threat Research

The full story

Extracted Entities

Attack Types (1)

Domains (3)

Malware (2)

MITRE ATT&CK (3)

Tools (1)