P7 DarkSword Malware Alert | iPhone Spyware Steals Passwords & Data

Apple’s iPhones are known for their security features, but that does not mean they are completely safe from cyberattacks. A new version of the DarkSword malware, called P7 DarkSword, has raised concerns over the sensitive information it can steal from iPhones.

According to a report by security firm iVerify, the updated malware can access saved password information, private notes, photos, installed apps, and data linked to certain cryptocurrency wallets. It can also communicate with attackers to receive further instructions while limiting some of its activities to avoid detection.

Here is everything iPhone users need to know P7 DarkSword, how it works, and what they can do to protect their personal information.

What is P7 DarkSword malware?

P7 DarkSword is a newer version of the DarkSword malware. Security firm iVerify gave it this name because of changes made to the original malware's code. The new version focuses on three main goals: staying hidden, avoiding repeated attacks on the same device, and stealing more information from victims.

According to iVerify, the malware has also been designed to reduce activities that could reveal its presence. It uses browser storage to help prevent the same iPhone from being targeted repeatedly.

Another major concern is its ability to process saved Keychain information directly on the device before sending stolen data to attackers. Apple's Keychain is a feature that securely stores information such as passwords and other sensitive details.

How can DarkSword steal data from iPhones?

The report states that P7 DarkSword can connect to a remote server controlled by attackers to receive instructions. By default, it checks for new commands every 15 seconds, although attackers can change this interval. Once it receives instructions, the malware can perform several activities to collect personal information, including:

Steal photos: It can upload images stored on the device.

Access saved passwords: It can process information stored in Apple's Keychain.

Collect private notes: It can copy Apple Notes databases that may contain personal information.

Check installed apps: It can create a list of applications installed on the iPhone.

Collect files: It can the device's storage for information of interest.

Target cryptocurrency data: It can look for information associated with certain cryptocurrency wallets.

The malware's ability to receive new instructions from attackers also means that its activities can change depending on what they want to access.

Also read: Amazon Great Indian Festival sale 2026 goes live: From Samsung and iPhone to OnePlus, top 7 smartphone deals Which iPhones could be at risk?