DarkSword Exploit Kit Returns With Remote Control and a Taste for Crypto Wallets

The DarkSword exploit kit has a new version, and it is built to steal crypto wallets from iPhones. Researchers at iVerify published the findings last week. They call the variant “P7”, after a variable prefix the attacker added to the original code. The kit first surfaced in March, and this update shows that someone kept working on it after the world got a look at the first release.

What the DarkSword exploit kit does

DarkSword is a full chain of iOS exploits. A victim visits a booby-trapped web page, and a series of bugs hands the attacker control of the phone. No tap or download is needed beyond the visit itself.

Google’s Threat Intelligence Group documented the original kit on 18 March, working with Lookout and iVerify. It supports iOS 18.4 through 18.7 and chains six vulnerabilities. Google saw it in use from at least November 2025. Three different actors used it, including a Turkish commercial surveillance vendor called PARS Defense and a suspected Russian espionage group tracked as UNC6353.

Apple has fixed all six flaws. Google says iOS 26.3 closes every one of them, and most were fixed in earlier releases.

What changed in the P7 variant of the DarkSword exploit kit

According to iVerify, the new build is quieter and tidier. The attacker removed debug logging that could give the game away and cut the number of process injections. It also uses the browser’s local storage to mark a phone as already infected, so the exploit does not fire twice and crash something.

The bigger change is control. The first release mostly grabbed data and left. P7 talks both ways with its command server. It checks in every 15 seconds and waits for orders, which the operator can slow down with a “sleep” command.

The command list reads like a remote admin tool. iVerify lists commands to run arbitrary JavaScript, list files, download files, pull photos, scan notes and report installed apps. Two commands deal with wallets: one checks which wallet apps are installed, and the other extracts data from the imToken app.

Why crypto wallets are the target

Wallet data is cash in a file. There is no bank to call and no chargeback. If an attacker lifts a recovery phrase or key, the funds can move in minutes.

The Hacker News, summarising work by Report URI and Censys, says the implant goes after files from more than 25 wallet apps, along with texts, contacts, photos and saved Wi-Fi passwords. Censys also reports that a separate operator added the BitKeep wallet. We have not verified those figures ourselves, so treat them as the researchers’ claims.

Keychain theft matters beyond crypto. P7 pulls keychain entries into a JSON file on the phone before it sends them out. That can include saved passwords, which a staff member may reuse for work systems.

How victims are reached

The Hacker News reports that one delivery route used a re-registered domain, ecomtrack[.]io. It injects malicious JavaScript into websites that still point at an expired analytics tag. A fake crypto platform served the same chain, according to that report.

The lesson is old but sharp. A forgotten script tag on your site is a door you left unlocked. If a lapsed domain gets bought by an attacker, every visitor to your site could be a victim.

What UK organisations should do this week

Most businesses will not be a direct target of the DarkSword exploit kit. Some staff will still carry company email, authenticator apps and saved passwords on personal iPhones. Four steps cover the risk:

• Update every iPhone. iOS 26.3 or later closes all six holes in the original chain. Check which devices are still on 18.x.
• Turn on Lockdown Mode for high-risk staff who cannot update yet. Google recommends it as a fallback.
• Audit third-party scripts on your own sites. Remove tags for services you no longer use, and check that every referenced domain is still yours or still trusted.
• Review mobile device management. Can you see OS versions across the fleet, and can you block out-of-date phones from company data?

If your business ships its own app, a test of your iOS app shows what an attacker with a foothold on the phone could pull from it. Keychain storage is a good place to start.

Patching discipline matters here as much as anywhere. Our plain patching checklist covers how to keep that routine from slipping.

The wider point

Exploit kits rarely vanish once they are public. Their authors tweak them and carry on. The DarkSword exploit kit is a clear example, because the P7 build adds control and stealth while relying on the same old bugs.

The fixes for this chain have been out for months, which makes the defence unusually simple: update the phone. It is dull advice, and it works. The firms that get hurt by kits like this are rarely the ones with a clever gap in their defences. They are the ones with a drawer full of phones nobody tracks.