New iPhone Spyware P7 DarkSword Can Steal Sensitive Data, Researchers Warn

A sophisticated new variant of iPhone spyware, dubbed P7 DarkSword, has been identified by security researchers capable of stealing a range of sensitive personal information, including saved passwords, photos, and Apple Notes. The spyware can also target cryptocurrency wallet data and operates by frequently communicating with attackers to receive commands. Mobile security company iVerify discovered P7 DarkSword while investigating an infected iPhone, detailing its capabilities in a report released on October 8, 2026.

Researchers found that P7 DarkSword can extract data from the iPhone's keychain, where passwords and other credentials are stored. It also targets cryptocurrency wallet applications, with specific functions identified to target the imToken wallet. The spyware can retrieve personal photos from the device and access Apple Notes databases. Additionally, it can inventory installed applications and retrieve selected files from their storage.

One of the more concerning features of P7 DarkSword is its command-and-control system, which can check for instructions from attackers as frequently as every 15 seconds. Attackers can remotely alter this interval, allowing for continued interaction with the infected device after the initial compromise. The malware injects its communication component into SpringBoard, a core system process responsible for the iPhone's Home Screen and other interface functions. To evade detection, attackers have also reportedly removed some diagnostic logging and reduced activities that might reveal the infection.

While the exact method of infection for the specific case investigated remains unclear, P7 DarkSword is associated with an iOS exploit chain. Attackers can potentially compromise vulnerable devices through malicious web content, often distributed via compromised websites or malicious advertisements, a tactic sometimes referred to as watering-hole attacks. These attacks exploit security weaknesses in older versions of the iPhone's operating system.

Apple stated that the vulnerabilities exploited by earlier versions of DarkSword were patched in 2025, prior to the spyware's leak. The company also released security updates in March 2026 for older devices unable to run newer iOS versions. According to Apple, iPhones running the latest updates for iOS 15 through iOS 27 are protected against the known DarkSword exploits. However, researchers identified exploit components associated with iOS 18.7 in the P7 variant, though they have not confirmed its ability to compromise fully updated iPhones. The latest available update depends on the iPhone model, and devices that have not received security updates may remain vulnerable.

To protect against such threats, security experts recommend installing the latest iPhone security updates immediately. Users can check for and install updates by navigating to Settings > General > About to view the current iOS version, and then returning to Settings > General > Software Update to download and install available updates. Enabling Automatic Updates can ensure devices receive future security fixes.

Further protective measures include enabling Background Security Improvements on iOS 27, which offer additional safeguards between major software updates. Users are also advised to exercise caution with unfamiliar websites and links, as malicious web content has been a vector for iPhone attacks. While antivirus software can offer some protection, such as blocking malicious websites, it may not detect sophisticated spyware.

For individuals facing particularly advanced threats, Apple's Lockdown Mode offers enhanced security by restricting certain features and connections. Security researchers have confirmed that known DarkSword exploits do not function on devices with Lockdown Mode enabled. To activate it, go to Settings > Privacy & Security > Lockdown Mode.

Given P7 DarkSword's ability to target passwords and financial information, users should secure their accounts with strong, unique passwords, enable two-factor authentication, and use a reputable password manager. Reviewing financial accounts for unusual activity and changing passwords from a separate, trusted device if a compromise is suspected are also crucial steps. If an iPhone is believed to be infected, users should avoid using it for sensitive activities and seek professional assistance before resetting the device, as this could destroy evidence.