TLDR
P7 DarkSword is a new iPhone spyware variant that can hunt for crypto wallets on compromised phones and extract wallet-related data, raising specific risks for mobile crypto users.
- Security researchers say P7 scans for wallet apps and targets data from imToken, Apple Keychain, Notes and photos on already-compromised iPhones.
- The spyware builds on older DarkSword exploits against certain iOS 18.418.7 versions, but there is no confirmed crypto theft tied specifically to P7 so far.
- For iPhone-based crypto users, device integrity, timely iOS updates and avoiding unsafe profiles and storage of seed phrases on the phone are the key defenses.
Deep Dive
1. How P7 DarkSword Targets Wallets
Security firm iVerify reported that P7 DarkSword can run a wallet_scan function to look for installed crypto wallet apps, and a wallet_extract command to pull files associated with the imToken wallet on infected devices, plus Apple Keychain credential data prepared in JSON for exfiltration from the phone itself. Researchers note it can also collect Apple Notes databases, photos and selected app files that might contain recovery phrases or wallet credentials, and it polls attacker servers every 15 seconds by default for new instructions, making data collection continuous once the phone is compromised. These capabilities mean that if you store private keys, seed phrases or wallet backups anywhere on the device, P7 can potentially find and send them to an attacker.
2. How Serious The Risk Is Today
P7 is described as a post-compromise spyware module - it runs after attackers have already exploited the device, not as a universal iOS zero day. Googles Threat Intelligence Group previously linked DarkSword campaigns to six vulnerabilities affecting iOS 18.418.7 in regions including Saudi Arabia, Turkey, Malaysia and Ukraine; Apple issued fixes starting in 2025 and released iOS 18.7.7 in March 2026 to extend protections. Current reporting explicitly says there are no confirmed crypto thefts, victim counts or loss figures tied directly to P7 yet, and it is not proven that it bypasses the latest iOS patches.
The biggest risk is to users who run outdated iOS versions, accept shady profiles or MDM enrollment, or store wallet secrets on the device, rather than to every iPhone user by default.
3. Practical Steps For iPhone Crypto Users
- Keep iOS updated to the latest version and consider Apples Lockdown Mode if you cannot update quickly; DarkSwords original exploit chain targeted specific older builds.
- Treat any device with unusual behavior, unverified configuration profiles or unexpected MDM enrollment as compromised, and assume wallet data on it may be exposed.
- Never store seed phrases or private keys in Notes, photos or generic files on the phone; use reputable hardware wallets or dedicated secure apps, and if you suspect compromise, move funds to a new wallet created on a clean device.
For mobile-heavy crypto users, the edge is in treating the phone as a high-value target, separating cold storage from daily-use wallets, and eliminating on-device traces of recovery phrases that spyware like P7 could harvest.
Conclusion
P7 DarkSword reinforces a straightforward lesson: once an iPhone is compromised, spyware can systematically search for crypto wallets and related secrets. The threat is real but targeted, anchored in specific exploit chains and user behaviors, so the most effective protection lies in keeping devices patched, refusing dubious profiles and separating long-term custody from anything that touches a potentially exposed smartphone.
CoinsKid.Com