DarkSword variant 'P7' steals iPhone passwords

'P7 DarkSword' has emerged. According to a report released October 8 by researchers at mobile security firm iVerify, an enhanced variant of 'DarkSword' — spyware that secretly surveils iPhones (malicious software that covertly extracts user information) — has been discovered. An analysis of an infected customer's iPhone in August 2026 revealed the threat behaving differently from previous versions. The name 'P7' comes from a prefix (a marker placed at the start of code) that the attackers added to their programming code.

The researchers identified multiple capabilities in the code. Much of the information this spyware targets is what people consider their most private data. The malicious code can extract passwords and various authentication credentials stored in the iPhone keychain. Photos, Apple Notes, and cryptocurrency wallet data were also classified as targets. In addition, it includes a communication feature that allows attackers to issue additional commands remotely.

That said, this research does not conclude that all iPhones are vulnerable. The researchers issued the warning based on findings from the devices they investigated.