Executive Summary
In late 2026, researchers identified P7 DarkSword, a significant evolution of the DarkSword iOS exploit kit. Attributed to diverse actors including suspected Russian group Star Blizzard and Turkish vendor PARS Defense, the kit has recently proliferated among Chinese-speaking financially motivated actors. P7 distinguishes itself from previous variants by reducing its forensic footprint, utilizing browser localStorage to track exploitation status, and shifting from database theft to local JSON extraction of keychains and crypto-wallets directly on the device.
The attack chain leverages vulnerabilities such as CVE-2025-24201 and CVE-2025-31200 to escape the WebKit sandbox and escalate privileges, eventually injecting the primary implant into the SpringBoard process. The C2 infrastructure enables high-frequency tasking (15-30 second polling) and granular data exfiltration including Apple Health data, photos, and recovery phrases for over 25 cryptocurrency wallet applications.
This threat represents a critical risk to high-value iOS users. The commercialization and subsequent leak of the DarkSword source code have lowered the barrier to entry, allowing less sophisticated actors to deploy potent spyware via abandoned e-commerce tracking tags and fake invitation lures. Organizations should prioritize mobile EDR and monitor for specific filesystem artifacts and known malicious domains identified in recent campaigns.