Spyware scans iPhone crypto wallets for data

TLDR

Security researchers have found P7 DarkSword, an iPhone spyware strain that scans for crypto wallet apps and can extract wallet-related data from already compromised devices.

1. P7 DarkSword polls an attacker server every 15 seconds, searches for wallet apps, and can pull data from specific wallets like imToken and Apple Keychain.
2. It is a post-compromise tool, not a new iOS zero-day, and there is no confirmed crypto theft yet, but mobile wallet data on an infected phone should be treated as exposed.
3. The main defenses are keeping iOS fully updated, avoiding sketchy profiles and MDM enrollments, and moving funds off any device that shows compromise signs.

Deep Dive

1. What The Spyware Actually Does

Security firm iVerify documented an upgraded spyware variant called P7 DarkSword that runs on infected iPhones and repeatedly checks in with attacker infrastructure every 15 seconds by default for instructions, including scanning for crypto wallets. Its `wallet_scan` function looks for installed wallet apps, while `wallet_extract` can pull files associated with the imToken wallet, and it also targets Apples Keychain, preparing extracted credentials as a JSON file before sending them out. P7 can additionally collect Apple Notes databases, photos and selected app files that may contain recovery phrases or wallet credentials, according to reports from iVerify and independent coverage of the spyware on iOS devices such as this analysis.

2. How Dangerous It Is For Crypto Users

Current reporting stresses that P7 is part of a post-compromise toolkit rather than a fresh iOS vulnerability, which means the device has to be compromised first before the spyware can scan for wallets or exfiltrate data. Earlier DarkSword campaigns chained multiple bugs in certain iOS versions, but Apple has already shipped fixes, including iOS 18.7.7, and recommends staying on the latest possible version. Investigators have not yet confirmed that private keys or seed phrases were successfully stolen or that any specific crypto theft is directly attributable to P7, and one community write up notes the absence of confirmed losses despite wallet-focused scanning behavior in recent infections.

3. Practical Protection And What To Watch

Reports highlight three practical risk controls for crypto users: keep iOS updated to versions that include DarkSword fixes, avoid installing unknown configuration profiles or mobile device management (MDM) packages, and treat any device with unusual behavior or untrusted management as unsafe for wallets. If you suspect compromise, best practice is to stop using that phone for crypto, migrate funds via a clean, verified device with a fresh recovery phrase, and then wipe or replace the phone. Going forward, watch for further disclosures on whether P7 has been seen actually draining wallets, and for Apple or wallet projects to publish additional hardening guidance.

Conclusion

P7 DarkSword does not break iPhones open by itself, but once a device is compromised it can systematically hunt for crypto wallets and exfiltrate sensitive data on a tight polling schedule. For mobile-first crypto users, the real risk is less about any single bug and more about treating phone integrity as a prerequisite for safe self custody, keeping software current, and isolating wallet activity from potentially infected devices.