Cybersecurity researchers have disclosed particulars of a beforehand unseen variant of the DarkSword iOS exploit equipment known as P7 DarkSword.
“In contrast with the variants we often observe, P7 reduces its on-device footprint, provides on-device keychain and crypto-wallet theft, and provides two method C2 communication with the attacker’s infrastructure,” iVerify stated in a brand new report printed Thursday.
The identify “P7” is a nod to the menace actor’s use of the “p7_” variable prefix in adjustments made to the unique DarkSword code.
DarkSword was first publicly documented earlier this March by Google Menace Intelligence Group (GTIG), iVerify, and Lookout, detailing its means to focus on iPhones working iOS variations between iOS 18.4 and 18.7. The equipment was detected within the wild in November 2025.
The toolkit is engineered to chain a number of iOS vulnerabilities to flee the browser sandbox, escalate to kernel privileges, and inject the primary payload into SpringBoard, the iOS course of that handles app launches and the house display screen. The exploit chain is assessed to be a business product that in some way landed in a second-hand market, from the place it was acquired by financially motivated operators and different menace actors since late 2025.
The exploit equipment has been put to make use of in assaults focusing on Saudi Arabia, Turkey, Malaysia, and Ukraine by a number of menace actors, together with a Turkish business surveillance vendor named PARS Protection by way of a faux Snapchat-themed web site and a Russia-aligned menace actor known as Star Blizzard (aka COLDRIVER) utilizing faux invitation lures.
In August 2026, assault floor administration platform Censys detailed a marketing campaign mounted by an unknown Chinese language-speaking menace actor that concerned focusing on Apple iOS gadgets with the exploit equipment, along with serving an Apple ID decoy sign-in web page.
As not too long ago as final month, iVerify stated it noticed “a number of unsuccessful, doubtless LLM-assisted makes an attempt to replace the framework to help iOS 26.x,” fueled by the leak of the exploit equipment shortly after its public disclosure. These variants, the cellular safety firm added, are targeted on stability, stealth, and high quality of stolen information.
iVerify informed The Hacker Information that it has additionally seen DarkSword and Coruna bundled collectively on uncommon events, calling the mixed deployment DarkCoruna.
“We consider these attackers obtained the supply for the Coruna exploit equipment and modified it,” iVerify stated. “There have been no indicators of binary patching concerned and enormous code adjustments had been achieved and compiled into new binaries.”
“Many bundled variants we see are non-working AI slop makes an attempt. Non-sophisticated attackers are deploying damaged/non-working variations of patched Coruna and DarkSword from GitHub. Nonetheless, we won’t rule out the chance that attackers unable to acquire the Coruna supply code may reverse-engineer and re-implement Coruna with the assistance of LLM fashions, we simply haven’t got proof of this occurring but.”
P7 DarkSword represents an evolution in these features by eliminating debug logging over HTTP requests and syslog and utilizing browser localStorage to stop re-exploitation. Not like prior variants that copied and exfiltrated the keychain database to course of on the attacker’s infrastructure, the brand new model extracts keychain information into JSON on the cellphone previous to exfiltration.
“The implant is injected into the SpringBoard course of, which handles all communication with the attacker’s infrastructure,” iVerify stated.
The most recent iteration is supplied to ballot for instructions each 15 seconds, ship a “heartbeat” message, ship an inventory of put in functions, and transmit iCloud Keychain data and information from functions like Apple Notes, Photographs, and cryptocurrency wallets.
The response to the periodic tasking ballot accommodates instructions to be executed on the sufferer’s cellphone. This consists of –
- execute_command, to execute working system instructions like ls, dir, cat, mkdir, rm, echo, ps, memdump, ipconfig, netstat, and whoami, amongst others
- ls, to checklist listing contents
- obtain, to learn a file from the system and add it to the C2 server
- images, to add picture recordsdata from “/var/cellular/Media/DCIM”
- apps, to enumerate app containers and extract bundle IDs
- exec, to execute arbitrary JavaScript immediately contained in the implant runtime
- file_upload, to recursively scan a number of paths and add matching recordsdata
- basic_info, to ship system metadata to the C2 server
- disk_scan, to recursively scan the filesystem ranging from “/,” document metadata for recordsdata, directories, and symlinks, and add the knowledge within the type of a report
- ios_app_data, to seek out app sandbox and app-group containers for requested bundle IDs and add chosen app recordsdata
- wallet_scan, to scan for put in pockets apps
- wallet_extract, to extract wallet-related information for imToken pockets app
- memo_scan, to add Apple Notes databases
- photo_scan, to add images from Apple Photographs
- sleep, to switch the beacon polling interval
- exit, to halt the beacon loop and cease the implant
Apparently, the identical P7 DarkSword exploit has been noticed being distributed by way of a site related to a now-defunct Czech e-commerce analytics startup. In line with Report URI, unknown menace actors have re-registered the area (“ecomtrack[.]io”) on September 15, 2026, following its expiry, to contaminate websites nonetheless incorporating monitoring tags referencing the analytics product with malicious JavaScript that delivers the malware.
“With the tag nonetheless sitting on on-line shops, it now hijacks guests, sells them on to advert networks, and in a single case, it delivers a full iOS exploit chain and spyware and adware implant,” safety researcher Scott Helme stated.
The brand new JavaScript incorporates varied evasive measures to detect crawlers, headless browsers, and bots, utilizing cloaking techniques to feed them empty content material to cover its tracks. It additionally collects details about the system and browser and sends the main points to an exterior server, after which the customer is redirected to a rip-off web site or an internet on line casino.
One route results in a bogus cryptocurrency buying and selling platform (“chainmate[.]high”) that stealthily serves the DarkSword iOS exploit chain. The implant delivered by way of the DarkSword is designed to seize SMS, contacts, name historical past, voicemail, images, Apple Well being information, location historical past, notifications, saved Wi-Fi passwords, and recordsdata belonging to greater than 25 pockets apps.
“The recovered code is configured to contact mertio.cc each 30 seconds and deal with instructions together with exec, obtain, images and spy,” Helme stated. “The construct we recovered seems to be newer (v24), and it reviews to totally different infrastructure and targets much more crypto wallets.”
The disclosure comes as Censys stated it recognized open directories on 5 hosts carrying elements associated to DarkSword and Coruna, one other iOS exploit equipment uncovered this 12 months as weaponized in assaults geared toward iPhone fashions working iOS variations between 13.0 and 17.2.1.
“Coruna is the companion payload equipment the identical ecosystem distributes,” Censys stated. “Its levels run contained in the sufferer’s browser session after DarkSword’s exploit levels land, and its wallet-harvesting modules steal crypto restoration phrases, balances, and keystore information from iOS apps. Operators run DarkSword and Coruna collectively towards their very own C2 infrastructure.”
The 5 hosts are listed beneath –
- 43.134.165[.]205, which serves DS-Fusion v1.0 (aka DarkSword Fusion), a mixed bundle that features each DarkSword and Coruna in a single bundle
- 166.88.95[.]90, which operates as a C2 server of the implant and has recorded two actual Chinese language iOS gadgets (183.154.173[.]30 and 182.239.114[.]223) polling a beacon web page each three seconds for a number of hours on September 6, 2026
- 23.148.212[.]237, which serves as an evaluation workspace that reveals the operator creating exploit chains for iOS 26 (resembling for CVE-2026-31001), which aren’t coated by DarkSword or Coruna.
- 47.102.192[.]23, which serves as a staging host for the Coruna equipment
- 156.239.230[.]120, which exposes your complete C2 platform and has been noticed polling a tool on September 15, 2026
An evaluation of the manufacturing server’s exploit registry has revealed that the DarkSword exploit equipment contains two CVE identifiers not beforehand documented –
- CVE-2025-24201, an out-of-bounds write vulnerability within the WebKit engine that would permit an attacker to interrupt out of the Net Content material sandbox (Mounted in iOS 18.3.2 and iPadOS 18.3.2)
- CVE-2025-31200, a reminiscence corruption vulnerability within the Core Audio framework that enables code execution when processing an audio stream in a maliciously crafted media file (Mounted in iOS 18.4.1 and iPadOS 18.4.1)
It is suspected that the open-directory cluster and the 156.239.230[.]120 platform are run by a Chinese language-speaking menace actor with an intention to conduct cryptocurrency pockets theft. That stated, precisely who’s behind is unknown.
“The platform runs a Chinese language-speaking exploitation-as-a-service operation,” Censys researcher Aidan Holland stated. “The admin panel exposes an agent/reseller mannequin, and a duplicate of the manufacturing server recovered 11 sufferer restoration phrases, 179 system loot directories, and a 75-account control-plane roster.”
Censys stated it additionally detected a separate China-based operator working the identical equipment within the wild towards its personal C2 server at “66ds[.]lol,” whereas together with a brand new cryptocurrency pockets goal (BitKeep) not current within the open-directory set. The findings as soon as once more spotlight the proliferation of the equipment amongst financially motivated actors.
“The operator behind it sits on Tencent and Shenyang internet hosting, tied to the operator by means of a singular self-signed certificates authority,” Censys stated.
(The story was up to date after publication to incorporate further insights from iVerify and Report URI.)
![11 social media tendencies each marketer ought to watch in 2026 [new data]](https://blog.aimactgrow.com/wp-content/uploads/2026/09/social20media20trends-1-120x86.png)
