iPhone spyware targets crypto wallet imToken

TLDR

A recently documented iPhone spyware chain can scan for crypto wallets and extract data from imToken, putting users of compromised devices at real risk of credential theft.

1. Security firms report the DarkSword spyware toolkit and its P7 variant hunting wallet apps and specifically pulling imToken-related files from infected iPhones.
2. The malware can also grab Keychain data and notes, so seed phrases and other credentials stored on the phone may be exposed, though large-scale crypto theft is not yet confirmed.
3. Updating iOS, treating any suspicious iPhone as compromised, and moving funds off risky devices while keeping seed phrases strictly offline are now critical for imToken users.

Deep Dive

1. Spyware Targeting imToken

Researchers describe P7 DarkSword, an upgraded iPhone spyware variant, that polls attacker servers every 15 seconds and uses a `wallet_scan` function to look for installed crypto wallets, with `wallet_extract` built to target imToken files specifically on compromised phones.iVerifys analysis and TokenPosts technical report both highlight this behavior.

The broader DarkSword exploit chain has also been seen deploying Coruna malware, which targets major wallets including imToken and can search photos and notes for BIP39 recovery phrases on vulnerable devices.Censys findings show the infrastructure is still active months after discovery.

2. How Serious The Threat Is

P7 DarkSword is a post-compromise spyware module, not a fresh, universal iOS flaw: the phone must already be exploited before the wallet scan and data collection start.TokenPost notes campaigns mainly against specific regions and older iOS versions.

So far, researchers have not confirmed that P7 or Coruna have successfully stolen private keys or directly drained imToken wallets, but they do confirm collection of wallet-related data, Apple Keychain credentials, notes, and photos. That makes any seed phrase or backup stored on-device a high-value target, even if the wallets own cryptography remains intact.

3. Practical Protection For imToken Users

1. Update your iPhone to the latest iOS version; Apple has patched the DarkSword exploit chain in recent releases, while older versions remain at higher risk.Macworlds summary via Censys emphasizes this point.
2. Treat devices with odd behavior, unknown configuration profiles, or unexpected mobile device management setups as compromised; avoid using them for any crypto activity, including imToken.
3. Move funds to a new wallet created on a clean, up-to-date device, and store seed phrases on paper or another offline medium, never in Notes, photos, or password managers on the phone.

Confidence: moderate because multiple security teams have documented the malware, but confirmed imToken theft cases remain limited or unpublished.

Conclusion

Spyware like DarkSword and its P7 variant turns a compromised iPhone into an active hunter for wallets such as imToken, blurring the line between secure app and unsafe device. For crypto users, the key shift is that phone-level compromises now directly threaten self-custody: keeping iOS patched, treating suspicious phones as burned, and keeping recovery phrases strictly offline are essential habits to limit the impact of this class of attacks.