P7 DarkSword Makes iPhone Spyware Harder to Detect, iVerify Finds

A newly uncovered iPhone spyware variant shows how an established exploit chain is evolving. Its quieter operation could make infections harder to identify.

iVerify researchers have discovered a new variant of the DarkSword iPhone spyware called P7 DarkSword. The discovery was made public on October 8, 2026. The variant was spotted while investigating an infection on a financial institution employee’s smartphone in August.

As reported by 9to5mac.com .

DarkSword is an exploit chain that uses iOS vulnerabilities to gain access to a device. Once the attack succeeds, malicious actors can install additional malware and access sensitive data.

What we know DarkSword and attacks

Earlier this year, Google and iVerify reported two sophisticated iPhone hacking tools: Coruna and DarkSword. Both combined several iOS vulnerabilities and targeted devices running older versions of the operating system.

Coruna targeted iPhones running iOS 13 through iOS 17.2.1, while DarkSword targeted devices running iOS 18.4 through iOS 18.7. After the threat was discovered, Apple released updates for older systems, including iOS 15.8.7, iOS 16.7.15, and iOS 18.7.7. The company also offered the latest update to devices compatible with iOS 26 to protect users who had not upgraded to a newer version.

According to Google, DarkSword was used by several commercial surveillance vendors and likely state-linked attackers. Attacks were recorded in Saudi Arabia, Turkey, Malaysia, and Ukraine.

How P7 DarkSword is different

Researchers link the name P7 to the p7_ prefix in modified sections of the original DarkSword code. According to iVerify, the new variant advances on versions in three areas: stealth, stability, and data theft capabilities.

P7 leaves fewer traces on the device by reducing the volume of activity logs and the number of process injections. It also uses browser data to avoid running the exploit again on the same iPhone. According to iVerify, these changes point to significant work by the malware operators, rather than simply automated code editing with AI.

The new version extends support to iOS 18.7; the previously tracked iVerify variant worked on iOS 18.6. Other DarkSword deployments observed by Google already supported iOS 18.7.

P7 can steal data from Keychain, the device’s system storage for credentials and keys. Rather than copying the entire database for later processing, the malware collects the data it needs directly on the iPhone. It also targets cryptocurrency wallet information.

The variant supports two-way communication with the attackers’ command-and-control infrastructure. This allows them to send commands to the device, including requests to retrieve arbitrary files, upload photos, check installed apps, access Apple Notes databases, collect information from specific app containers, and scan the file system.

How the spyware is distributed

According to iVerify, P7 operators use malicious advertising and attacks through infected or compromised websites. Victims are therefore not necessarily specific targets: a user may be attacked while viewing unsafe web content as part of a broader campaign.

iVerify warns that changes to P7 have made infections harder to detect, and indicators of compromise that worked for variants are no longer reliable. However, P7 does not exploit a new iOS vulnerability: it is a new version of the malware installed after a successful DarkSword attack. iVerify did not specify which iOS version was running on the device where P7 was found.

The discovery of P7 shows that DarkSword continues to evolve following disclosures. iOS updates patch known vulnerabilities, but the spyware’s new capabilities make it harder to detect devices that may already have been compromised.

You may be interested in these materials:

Security researchers say a Russian-linked hacking group UNC6353 used a new iPhone exploit called Darksword to target Ukrainian users, stealing passwords, messages, photos, browser history and possibly cryptocurrency.

Ukraine’s State Service of Special Communications reports that hackers used DarkSword, fake Android pages and legitimate online services to target smartphones and access sensitive data in early 2026.