TLDR
New iPhone spyware is actively scanning compromised devices for crypto wallet apps and wallet data, increasing theft risk for users on older or unpatched iOS versions.
- Security firms have identified DarkSword and its P7 spyware variant, which hunt for installed crypto wallets and related data on infected iPhones.
- The main danger is exposure of wallet credentials and recovery phrases, though large-scale confirmed crypto theft from P7 has not yet been reported.
- Updating iOS, hardening device security, and keeping seed phrases off the phone are key to reducing this risk for crypto users.
Deep Dive
1. What The Spyware Actually Does
Researchers describe DarkSword and its upgraded P7 DarkSword variant as iPhone spyware that operates after a device is already compromised, not as a new general iOS flaw.
The P7 variant periodically contacts attacker servers every 15 seconds and runs commands to scan for installed wallet apps and extract wallet-related data, especially from the imToken self-custody wallet. It can also package Apple Keychain credentials into JSON files and collect Apple Notes databases, photos and selected app files, which may contain wallet information or recovery phrases. These capabilities are documented by security firm iVerify and summarized in recent reporting on P7 DarkSword.
Related work on the DarkSword exploit chain shows it can be paired with Coruna malware to target popular wallet apps such as Coinbase, MetaMask, Trust Wallet, Phantom, Exodus, Uniswap, Bitpie, imToken and OKX, and to search photos and notes for BIP39 recovery phrases, the 12 to 24 word seed phrases used to recover wallets.
2. How Big The Risk Is Right Now
For P7 DarkSword, investigators have not yet confirmed successful crypto theft, numbers of affected users or a loss total. The spyware is clearly capable of identifying crypto users and extracting sensitive data, but it is not yet tied to a specific drain campaign.
Earlier DarkSword campaigns exploited a cluster of WebKit and JavaScriptCore vulnerabilities in certain iOS 18 builds, targeting users in several countries. Apple has issued patches for the documented bugs and more recent iOS releases include fixes. Separate coverage notes that all known vulnerabilities used by the DarkSword kit have been patched in current iOS versions. Unpatched or older devices remain at higher risk if they can still be reached by an exploit chain.
The real danger today is for users on older iOS versions or phones that are already compromised, where spyware can silently map which wallets you use and collect data that might later be used to steal funds or extort you.
3. Practical Defenses For iOS Crypto Users
For crypto users on iPhone, risk mitigation focuses on both device security and wallet hygiene.
- Keep iOS and browser components fully updated and avoid jailbreaking or installing unverified profiles or mobile device management tools, which can open the door to exploitation.
- Never store seed phrases or private keys in photos, notes, screenshots or plain text files on the phone; treat mobile storage as potentially observable by malware.
- Favor strong device passcodes, hardware wallets bought directly from manufacturers, and official wallet apps from trusted storefronts, and be cautious about links or attachments claiming to fix security issues.
If you use an iPhone for crypto, the biggest practical steps are to stay current on iOS updates, restrict what sensitive data lives on the device, and assume that anything written down on the phone could eventually be read by an attacker.
Conclusion
iPhone spyware like DarkSword and P7 DarkSword shows that attackers are increasingly targeting the intersection of mobile security and self-custody crypto. While current reports focus on capability rather than confirmed large losses, the tools are designed to find wallet apps and recovery phrases and to quietly harvest data from compromised devices. For crypto users, the advantage lies in reducing the amount of sensitive information available to such spyware and in keeping iOS devices as hard a target as possible through updates and cautious app and profile installation.
CoinsKid.Com