TLDR
Security researchers have found an iPhone spyware strain that hunts for crypto wallet apps and can pull wallet-related data from compromised phones.
- P7 DarkSword is iPhone spyware that runs on already hacked devices, repeatedly scanning for wallet apps and extracting data from the imToken wallet.
- The malware can also collect Apple Keychain, Notes, photos, and app files that may contain seed phrases or credentials, though no crypto theft is confirmed yet.
- Crypto users with iPhones should prioritize device integrity, keep iOS updated, watch for suspicious profiles or MDM, and move wallets off any phone they suspect is compromised.
Deep Dive
1. What P7 DarkSword Actually Does
According to security firm iVerify, P7 DarkSword is an upgraded iPhone spyware variant that can identify crypto wallet users and extract wallet-related data from compromised phones, including targeted imToken files every 15 seconds via its wallet_scan and wallet_extract commands. It also polls an attacker-controlled server frequently, allowing operators to issue new instructions without re-exploiting the device, making post-compromise surveillance continuous and stealthy. Reports note that it is not a fresh, universal iOS vulnerability but a tool used after an iPhone has already been exploited in a broader DarkSword attack chain targeting specific iOS versions and regions, which Apple has since patched in newer releases.
2. How Serious The Risk Is So Far
Current reports state that P7 DarkSword can harvest Apple Keychain data, Notes databases, photos, and selected app files, any of which may contain recovery phrases or login details for wallets, but they explicitly say there is no confirmed case of stolen cryptocurrency or proven private key extraction yet. The spyware was observed in infections from early 2026, and associated iOS vulnerabilities have received fixes, including an iOS 18.7.7 update and earlier patches, but these protections only help devices that are actually updated. Practically, once an iPhone is compromised, wallet data stored on or generated by that device should be considered exposed, even if attackers have not yet acted.
3. Practical Protection For iPhone Wallet Users
- Keep iOS on the latest version and consider Apples hardened modes, as Googles threat team recommended for users who cannot update immediately.
- Treat unexplained mobile device management (MDM) enrollment, strange configuration profiles, or unusual phone behavior as red flags and stop using that device for crypto activity.
- If you suspect infection, migrate funds to a new wallet created on a different, trusted device with a fresh recovery phrase, and avoid storing seeds or credentials in Notes, photos, or general-purpose apps.
Your crypto is only as safe as the phone it lives on, so treating device compromise as a full wallet compromise is a conservative but realistic stance.
Conclusion
The discovery of P7 DarkSword shows that attackers are now explicitly targeting mobile crypto users by scanning for wallet apps and harvesting surrounding data once an iPhone is compromised. Even though no confirmed theft has been linked to this spyware yet, it reinforces a broader trend where wallet security depends not just on a good app, but on a fully trustworthy device, clean operating system, and disciplined handling of recovery phrases and credentials. For anyone using iPhones for self-custody, the main safeguard is maintaining device integrity and being willing to migrate to a clean setup at the first credible sign of compromise.
CoinsKid.Com