New iPhone spyware P7 DarkSword can harvest passwords, photos and crypto data
Security researchers at iVerify have identified a new iPhone spyware variant, P7 DarkSword, capable of stealing keychain passwords, photos, notes and cryptocurrency wallet information, while checking in with its operators every 15 seconds.
Security firm iVerify discovered a new iteration of the DarkSword iPhone spyware, named P7 DarkSword, during a probe of a compromised device in August 2026. The upgraded code expands data-collection capabilities, allowing extraction of keychain passwords, cryptocurrency wallet details from the imToken app, personal photos, Notes databases and specific application files. It communicates with its command-and-control server as often as every 15 seconds and injects its communications component into the SpringBoard system process to evade detection.
The spyware is delivered via malicious advertisements and compromised websites that exploit outdated iOS vulnerabilities; Apple patched the underlying flaws in 2025 and issued further updates in 2026. Devices running the latest iOS versions and employing Lockdown Mode are reported to be immune to the known exploits. Experts recommend updating iPhones, enabling automatic security updates, activating background security improvements, and using strong passwords with two-factor authentication to mitigate risk.
Why it matters
The discovery shows that even updated iPhones can be targeted by sophisticated spyware, threatening personal data and financial assets.
In this story
