iPhone spyware targets crypto wallet imToken

TLDR

New iPhone spyware called P7 DarkSword can scan compromised devices for crypto wallets and specifically target imToken data, increasing risk for users whose phones are already infected.

1. P7 DarkSword is post-compromise iOS spyware that scans for wallet apps and can extract data from the imToken wallet on infected iPhones.
2. So far there is no confirmed evidence of stolen crypto via this tool, but it can exfiltrate sensitive data like credentials, notes and wallet-related files.
3. Updating iOS, avoiding shady profiles/MDM, and treating any suspicious iPhone as unsafe for wallet use are key defenses for imToken and other wallet users.

Deep Dive

1. How The Spyware Targets imToken

Security firm iVerify documented P7 DarkSword as an upgraded iPhone spyware variant that contacts its control server every 15 seconds and scans for installed wallet apps, with a dedicated `wallet_extract` function that targets imToken files on compromised phones. Reports note that it can search for wallet apps, then focus on data tied to the imToken wallet rather than just generic app metadata, making it more dangerous for affected users than broad spyware that ignores crypto apps.[^1][^2]

Crucially, P7 DarkSword is a post-compromise tool, not a new iOS zero-day that infects every device by itself. Earlier DarkSword campaigns exploited specific iOS 18.418.7 versions in limited regions, and Apple has shipped patches in later iOS releases.[^2]

2. What Data And Funds Are At Risk

Research indicates P7 DarkSword can collect:

1. imToken-related data via its `wallet_extract` capability.[^1][^2]
2. Apple Keychain credentials, prepared as JSON on-device, plus Apple Notes databases and selected app files that might contain passwords or recovery phrases.[^2]
3. Photos and app files, which could reveal QR codes, seed phrases or other wallet information stored insecurely.

Investigators and iVerify have not confirmed that P7 DarkSword operators have actually stolen cryptocurrency or private keys, and there are no public figures for affected users or total losses.[^1][^2] Still, if a seed phrase or private key is ever stored in Notes, screenshots, or accessible app files, this class of spyware could expose it.

3. Practical Steps For imToken iPhone Users

For imToken (and any mobile wallet) on iOS:

1. Update to the latest iOS version and enable automatic updates, since the documented exploit chain targeted older 18.x builds.[^2]
2. Avoid installing configuration profiles, enterprise/MDM enrollments or apps from untrusted sources; iVerify warns that unusual profiles or MDM on an iPhone can signal compromise.[^1]
3. Never store seed phrases in Notes, photos or email on the phone; keep them offline and separate from any internet-connected device.
4. If your iPhone shows suspicious behavior or you suspect compromise, treat it as unsafe for wallet use, move funds from that wallet using a known-clean device, and then fully wipe and rebuild the phone.

Conclusion

P7 DarkSword highlights that once an iPhone is compromised, targeted spyware can hunt for crypto wallets like imToken and extract highly sensitive data even without a fresh iOS zero-day. The main defense is preserving device integrity, keeping wallets and seed phrases away from risky environments, and acting quickly to rotate keys and devices if compromise is suspected.

[^1]: TokenPost summary of P7 DarkSwords imToken targeting [^2]: CryptoSlate analysis of the new iPhone spyware capabilities