Cybersecurity
P7 DarkSword adds wallet theft and remote commands
iVerify said a new DarkSword variant, P7 DarkSword, reduced its footprint, added on-device wallet theft and remote command handling, and appeared in infrastructure Censys linked to several campaigns.
- iVerify said P7 DarkSword was a previously unseen DarkSword variant, and it said the name came from the p7_ prefix in code changes.
- iVerify said the variant reduced its on-device footprint, moved keychain extraction onto the phone, and added two-way command-and-control communication.
- Censys said it found DarkSword and Coruna on shared infrastructure, including a DS-Fusion v1.0 bundle and a production server with an agent/reseller model.
- Censys said the production server’s exploit registry included CVE-2025-24201 and CVE-2025-31200, and that a separate China-based operator used the kit with BitKeep.
iVerify said P7 DarkSword was a new variant of DarkSword and that its name came from the p7_ prefix in altered code. It said the variant cut on-device traces, moved keychain handling onto the phone and added two-way command traffic.
DarkSword had first been documented in March by Google Threat Intelligence Group, iVerify and Lookout, with targets on iPhones running iOS 18.4 to 18.7. The kit was said to chain browser sandbox escape, kernel privilege gain and payload injection into SpringBoard.
The source said the exploit chain appeared to be a commercial product that later circulated on a second-hand market. It said multiple actors had used it in Saudi Arabia, Turkey, Malaysia and Ukraine, including PARS Defense and Star Blizzard, also called COLDRIVER.
Censys said it found open directories on five hosts linked to DarkSword and Coruna, including a DS-Fusion v1.0 bundle and a Coruna staging host. It said Coruna ran after the browser exploit stages and stole recovery phrases, balances and keystore data from iOS apps. Aidan Holland said the platform ran as an exploitation-as-a-service operation with an agent/reseller model, and that a copied server held 11 victim recovery phrases, 179 device loot directories and a 75-account control-plane roster.
Censys said the production server’s exploit registry exposed CVE-2025-24201 and CVE-2025-31200. It also said it had seen a separate operator in China using the same kit against its own C2 server and adding BitKeep as a target.
Named in this story
People
- Aidan Holland
- the Censys researcher quoted on the platform
Companies
- iVerify
- said it found and analysed the P7 DarkSword variant
- Lookout
- helped document DarkSword in March
- PARS Defense
- used DarkSword in attacks with a fake Snapchat-themed site
- Censys
- reported the infrastructure and host findings around the kit
Organisations
- Google Threat Intelligence Group (GTIG)
- helped document DarkSword in March
- Star Blizzard (aka COLDRIVER)
- used DarkSword with fake invitation lures
Products and systems
- DarkSword
- the original iOS exploit kit first documented in March
- P7 DarkSword
- the new variant with a smaller footprint and added theft and command features
- SpringBoard
- the iOS process the implant was injected into
- Coruna
- the companion payload kit paired with DarkSword
- DS-Fusion v1.0 (aka DarkSword Fusion)
- the combined bundle that included DarkSword and Coruna
- iCloud Keychain
- one of the data sources the implant exfiltrated
- Apple Notes
- one of the apps whose data the implant could collect
- Apple Photos
- one of the apps whose data the implant could collect
- imToken
- the wallet app singled out for wallet extraction
- BitKeep
- an additional wallet target seen in a separate operator’s deployment
How the source tells it
The article was a technical threat-intelligence report with little overt emotive framing.
No emotive framing was found in the original.