Researchers at iVerify have described P7 DarkSword, a new variant of the DarkSword iOS exploit kit that adds on-device keychain and cryptocurrency-wallet data theft along with two-way command-and-control communications. The toolkit chains iOS vulnerabilities to escape the browser sandbox, gain kernel-level access and inject an implant into the SpringBoard process.
The new variant is designed to reduce its on-device footprint and can collect application inventories, keychain information, Notes, Photos and wallet-related data. Reporting also links a delivery path to an expired analytics domain that was re-registered and used to serve malicious JavaScript to sites still loading its tracking tags.
Mobile defenders should keep iOS devices updated, investigate suspicious web redirects and tracking-tag changes, and review third-party JavaScript dependencies—especially abandoned services. Organizations with high-risk users should pair mobile threat defense with browser and DNS telemetry to find exploit-delivery activity early.