A new variant of the DarkSword iOS exploit kit has surfaced, and it is meaningfully more dangerous than what researchers have tracked before. Dubbed P7 DarkSword, the toolkit was disclosed by mobile security firm iVerify and represents a significant upgrade over earlier versions — not just in what it steals, but in how it operates on a compromised device.

The headline additions are two-fold. First, P7 can now reach directly into iOS keychain data and crypto wallet storage, meaning it can silently drain credentials and digital assets without any visible action from the victim. Second, and more importantly, the kit now supports bidirectional command-and-control — the attacker's infrastructure doesn't just receive stolen data, it can issue live instructions back to the compromised device. That turns a passive exfiltration tool into something closer to a remote access trojan.

What makes this harder to detect is the other change: P7 deliberately reduces its on-device footprint. It does less on the phone itself, offloading more of the heavy lifting to the C2 infrastructure. For defenders and forensic analysts, a smaller footprint means fewer artefacts to find, and a shorter window to catch the compromise before it's complete.

iOS has long been positioned as the more secure mobile platform, and for most consumer threat models, that reputation holds. But DarkSword's evolution is a reminder that sophisticated mobile exploit kits do exist, are actively developed, and are increasingly capable. The addition of crypto wallet theft in particular signals who the kit's operators are targeting — high-value individual holders, not just enterprise accounts.

For Australian users, the risk profile is real. Australia has one of the highest rates of cryptocurrency ownership per capita in the Asia-Pacific region, and iOS is the dominant smartphone platform here. Attacks that combine keychain access with live C2 instructions could be used to bypass app-level two-factor authentication, making even security-conscious users vulnerable if their device is compromised at the OS level.

The immediate mitigations are the obvious ones: keep iOS updated, avoid sideloading profiles from unknown sources, and treat any unusual battery drain or network activity as a flag worth investigating. iVerify's mobile threat detection tooling — which is available to enterprise customers — is what caught this variant, which underscores the gap between what Apple's built-in protections catch and what a dedicated mobile EDR solution can surface.

What to watch: iVerify hasn't attributed P7 DarkSword to a specific threat actor yet, but the crypto wallet targeting and the C2 sophistication both point toward a financially motivated operator with significant development resources. Whether this surfaces in wider incident data — or stays targeted at high-value individuals — will tell us a lot about who is behind it and what comes next.

The broader DarkSword family has been evolving quietly. P7 suggests that evolution is accelerating.