-2.png?w=1024)
An iPhone infection could now give DarkSword operators more than a one-time haul of files. A newly documented variant can extract Apple Keychain and cryptocurrency wallet data, then receive fresh commands from attackers.
Mobile security company iVerify disclosed P7 DarkSword on Oct. 8 after investigating a customer's infected phone in August. The modified spyware reduces some traces of its activity and contacts attacker infrastructure for further instructions. For employees using iPhones to access corporate services, the concern extends beyond personal information to credentials that could open work accounts.
P7 DarkSword extracts Keychain data and accepts remote commands
iVerify found that P7 processes Keychain data into a JSON file on the iPhone before sending it to attackers. Earlier DarkSword variants instead copied the database for processing on attacker infrastructure. P7 also reduces process injections and logging, and uses browser storage to avoid repeated exploitation.
After injection into SpringBoard, the iOS process that manages the home screen, the implant polls an attacker-controlled server about every 15 seconds. Operators can request Apple Notes, photos, app files, and wallet data, inspect directories, or execute commands. They can also change the polling interval remotely.
An expired analytics domain helped deliver DarkSword
The Hacker News reported Oct. 12 that attackers re-registered ecomtrack[.]io, an expired domain belonging to a former e-commerce analytics provider. Stores still loading its tracking tag unwittingly sent some visitors through malicious redirects. One route led to a bogus cryptocurrency site serving a DarkSword iOS exploit chain.
Previously documented DarkSword attacks targeted certain versions of iOS 18, including 18.4 through 18.7. The available reporting does not establish that every iPhone is vulnerable or that P7 can compromise fully updated devices.
Stolen Keychain data could expose corporate accounts
A compromised Keychain may contain credentials relevant to email, cloud services, or work apps, depending on what the user stored and what the malware accessed. Remote commands compound that concern because investigators must establish which additional information an operator may have collected.
Aviatrix mapped the threat to Keychain credential access and data exfiltration, underscoring the need to investigate connected accounts as well as the phone itself. Its analysis did not establish a confirmed financial loss from P7.
Security teams should check iPhones and exposed accounts
Prioritize unpatched iPhones that access sensitive business systems, including employees' personal devices where appropriate. An outdated iOS version warrants review, but is not evidence of infection.
- Hunt for indicators: Review available mobile threat and network telemetry for iVerify's reported command-and-control domain, agdx53[.]cc. Where forensic access permits, check for /private/var/tmp/keychain_c2_dump.json.
- Contain suspected devices: Restrict their access, preserve evidence, and examine unusual sign-ins or file activity in connected business accounts.
- Secure potentially exposed credentials: Revoke active sessions, rotate relevant passwords from a trusted device, and assess wallet recovery information if cryptocurrency accounts were present.
Website operators should also audit old analytics tags and confirm their domains remain under legitimate control. Updating iOS helps prevent exploitation of patched flaws, but cannot recover information already stolen. Treat a suspected DarkSword infection as both a device incident and a possible account compromise. Otherwise, an attacker may retain access long after the phone has been secured.
DarkSword has also appeared in a separate iPhone scam. See how a fake iPhone Duo preorder page attempted to exploit unpatched devices and what users can do to protect themselves.