New P7 DarkSword Spyware Targets iPhone Users via Malicious Ads

Ender Öztürk

October 9, 2026

Security firm iVerify has issued a critical warning regarding the emergence of P7 DarkSword, a highly sophisticated variant of the previously identified DarkSword spyware. First discovered in August after targeting the iPhone device of a financial institution employee, this malicious software specifically exploits outdated iOS versions to gain unauthorized access to sensitive user data. Unlike its predecessors, P7 DarkSword operates with increased stealth, enabling cybercriminals to steal cryptocurrency wallet credentials and maintain near-total control over infected devices. Security experts emphasize that the threat is primarily spread through malicious advertisements embedded in web content, putting a wide range of users at significant risk.

Cybercriminals Develop More Advanced Strategies

Technical analysis by iVerify indicates that the P7 DarkSword variant represents a major operational evolution rather than a simple code update. While earlier versions of the malware focused on one-way data exfiltration, the P7 iteration establishes a two-way communication channel that sends reports to the attacker every 15 seconds. This persistent connection allows cybercriminals to exert complete control over Apple Notes, photo galleries, and other private application data.

A particularly concerning aspect of this attack is the process of data manipulation directly on the device, specifically the export of Keychain credentials. This sophisticated method helps the malware bypass traditional security detection tools. Furthermore, P7 DarkSword is designed to manage system resources efficiently, ensuring that the device does not experience significant performance drops, which often serves as a primary red flag for users.

Watering-Hole Attacks Become Increasingly Common

The distribution of P7 DarkSword relies on a broad “watering-hole” strategy rather than targeting specific individuals. By compromising legitimate-looking websites that host malicious scripts, attackers can infect a high volume of users simultaneously. This approach allows hackers to build a massive infection network, casting a wide net to harvest sensitive information from any vulnerable device that visits the compromised page.

Users Must Update Their Security Protocols

The discovery of P7 DarkSword has rendered many previous indicators of compromise obsolete, as the software is highly effective at purging its own tracks. Security researchers urge users to remain vigilant against suspicious links and advise performing regular security scans if any unusual device activity is observed. While Apple has released iOS updates that address known vulnerabilities, the most effective defense remains keeping the operating system updated to the latest available version.

How do you manage your personal data privacy against the rise of sophisticated mobile spyware? Do you believe Apple should implement stricter restrictions on web content to prevent such attacks? Share your thoughts and experiences in the comments section below.