iVerify Reports New P7 DarkSword iPhone Malware Variant

iVerify published a report on October 8 detailing P7 DarkSword, a previously unseen variant of malware linked to the DarkSword iPhone exploit chain. The company said it discovered the variant while investigating an infection on the iPhone of an employee at a financial institution in August 2026, according to 9to5Mac.

P7 DarkSword expands compatibility to iOS 18.7, while the earlier variant iVerify had been tracking supported iOS 18.6. The threat actor behind P7 distributes it through malicious ads as part of watering-hole attacks.

The new version reduces its on-device footprint and adds on-device Keychain and crypto-wallet theft, along with two-way command-and-control communication. It can extract Keychain data directly on the iPhone before sending it to attackers.

Remote commands and check-in interval

P7 DarkSword can receive commands to retrieve arbitrary files, upload photos, inventory installed apps, access Apple Notes databases, collect data from app containers, and scan the device filesystem. By default it checks in with the attackers' command-and-control server every 15 seconds, an interval that can be changed remotely.

iVerify described P7 as a new version of malware deployed after a DarkSword compromise, not a new iOS vulnerability.

Earlier in 2026, Google and iVerify revealed two iPhone hacking tools, Coruna and DarkSword, that chained multiple iOS vulnerabilities. Coruna targeted devices running iOS 13 through iOS 17.2.1, while DarkSword affected iPhones running iOS 18.4 through iOS 18.7. Apple released iOS 15.8.7, iOS 16.7.15, and iOS 18.7.7 updates for affected older iOS versions, and made iOS 18.7.7 available to devices that could install iOS 26. Google said DarkSword was used by commercial surveillance vendors and suspected state-sponsored actors, with attacks in Saudi Arabia, Turkey, Malaysia, and Ukraine.