P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

Security researchers at iVerify have uncovered a new strain of the DarkSword iOS exploit kit, dubbed P7 DarkSword after the "p7_" variable prefix found in its modified code. Compared to earlier versions first documented in March by GTIG, iVerify, and Lookout, this variant shrinks its on-device footprint, adds theft of keychain and cryptocurrency wallet data, and introduces two-way command-and-control communication through implants injected into the SpringBoard process. The kit, originally a commercial exploit chain targeting iOS 18.4 through 18.7, apparently leaked onto a secondary market and is now used by financially motivated actors and state-linked groups—including Turkish vendor PARS Defense and Russia's Star Blizzard (COLDRIVER)—against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. Censys further identified open directories tied to DarkSword and its companion wallet-stealing kit Coruna, revealing two previously unlinked flaws, CVE-2025-24201 (WebKit sandbox escape, fixed in iOS 18.3.2) and CVE-2025-31200 (Core Audio code execution, fixed in iOS 18.4.1), as well as a Chinese-speaking exploitation-as-a-service operation with victim data including 11 recovered crypto seed phrases.