# P7 DarkSword iOS Exploit Kit Targets Crypto Wallets with Enhanced Capabilities

*Published October 12, 2026*
*Source: [https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html](https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/p7-darksword-ios-exploit-kit-targets-crypto-wallets-with-enhanced-capabilities) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Researchers have uncovered a new variant of the DarkSword iOS exploit kit, known as P7 DarkSword, which introduces several advanced features. This latest version is designed to steal keychain and cryptocurrency wallet data while enabling two-way communication with the attacker's infrastructure. P7 DarkSword represents a significant evolution from previous variants by reducing its on-device footprint and incorporating two-way command and control capabilities.

Originally documented in March, the DarkSword exploit kit targets iPhones running iOS versions from 18.4 to 18.7, utilizing a chain of vulnerabilities to gain kernel privileges and inject its payload into the SpringBoard process. This exploit kit has been actively used in attacks across Saudi Arabia, Turkey, Malaysia, and Ukraine by various threat actors, including a Turkish surveillance vendor and a Russia-aligned group.

Recent developments indicate that variants of P7 DarkSword are being distributed through domains linked to defunct startups, such as ecomtrack.io, repurposed to deliver malware via malicious JavaScript. This JavaScript employs evasive techniques to bypass detection, redirecting users to scam sites or online casinos, and ultimately deploying the exploit chain.

The DarkSword kit is particularly dangerous as it captures a wide array of personal data, including SMS, contacts, call history, and information from more than 25 wallet apps. The exploit has been observed contacting a command server every 30 seconds, executing commands, and targeting a growing number of cryptocurrency wallets.

In addition to DarkSword, a related exploit kit named Coruna is being used in tandem, targeting iPhones with iOS versions between 13.0 and 17.2.1. Coruna specializes in stealing cryptocurrency recovery phrases and other sensitive data from iOS apps. These findings underscore the ongoing threat posed by financially motivated cybercriminals leveraging sophisticated exploit kits to target and steal cryptocurrency assets.