P7 DarkSword iOS Exploit Kit Expands Capabilities with Crypto Theft and Remote C2

A newly identified variant of the DarkSword iOS exploit kit, designated P7 DarkSword, has surfaced in active espionage and financially motivated attack campaigns. Operating primarily against Apple devices running iOS versions 18.4 through 18.7, this upgraded framework introduces significant operational stealth, local JSON parsing of extracted Keychain credentials, and two-way command-and-control (C2) communication. DarkSword reliance on WebKit memory corruption vulnerabilities—such as the out-of-bounds write flaw CVE-2025-24201—allows threat actors to achieve remote code execution inside the browser, break out of the sandbox, escalate privileges to the kernel level, and inject an implant directly into the SpringBoard process.

Originally developed as a commercial surveillance product, the underlying DarkSword codebase leaked into secondary markets in late 2025. Since then, diverse threat groups have adopted and modified the exploit kit for targeted surveillance and credential harvesting.

Technical Analysis of the P7 Variant

The P7 variant—named after the p7_ variable prefix added throughout its modified source code—represents an architectural shift in how the implant manages stolen telemetry and evasive tactics. Previous DarkSword iterations copied the raw device SQLite keychain database and exfiltrated it wholesale to external infrastructure for offline decryption. In contrast, P7 parses the Keychain directly on the victim’s device, structuring saved credentials, Wi-Fi passwords, and app data into JSON objects prior to transmission.

To maintain stealth and evade mobile security software, P7 suppresses HTTP debug logging and system log (syslog) outputs. It also writes state markers to the browser’s localStorage to avoid repeatedly re-exploiting the same host during subsequent visits.

Once injected into SpringBoard, the implant establishes a two-way HTTP beacon with its C2 server, polling for new tasking every 15 seconds. The platform supports a robust command set:

• execute_command: Executes operating system commands locally (e.g., ls, cat, ps, memdump, netstat, whoami).
• download: Retrieves specific files from the iOS filesystem and uploads them to the attacker infrastructure.
• photos: Harvests photo media located in /var/mobile/Media/DCIM.
• exec: Executes arbitrary JavaScript inside the implant’s runtime context.
• disk_scan & file_upload: Recursively scans directories starting from root (/) to build file structure reports and exfiltrate matching target paths.
• ios_app_data & wallet_extract: Identifies application sandbox containers by bundle ID to extract sensitive local databases, explicitly targeting the imToken application and more than 25 other cryptocurrency wallet apps.

Supply Chain Hijacking and Active Campaigns

Threat actors are deploying DarkSword across multiple regional targets, including victims in Saudi Arabia, Turkey, Malaysia, and Ukraine. Known threat actors operating the toolkit include Turkish commercial surveillance vendor PARS Defense (using fake Snapchat-themed landing pages) and Russia-aligned group Star Blizzard (COLDRIVER, using fake event invitation lures). Unknown Chinese-speaking actors have also used the framework alongside Apple ID credential phishing portals.

A notable delivery vector involves a supply chain attack leveraging the domain ecomtrack[.]io. Formerly belonging to a defunct Czech e-commerce analytics startup, the domain expired and was re-registered by threat actors on September 15, 2026. Online stores that failed to clean up legacy tracking tags still load scripts from the domain.

The re-registered domain now serves evasive JavaScript designed to filter out bots, crawlers, and automated security scanners. Legitimate human visitors are redirected through intermediate ad networks or scam sites, with a subset routed to a fake cryptocurrency trading platform hosted at chainmate[.]top. This site silently delivers the DarkSword exploit chain to visiting iOS browsers. A related variant (v24) identified in this campaign contacts mertio.cc every 30 seconds to transmit contacts, SMS, call logs, voicemail, health records, location history, and wallet recovery keys.

Infrastructure and Combined Exploits (DarkCoruna)

The DarkSword ecosystem frequently overlaps with Coruna, a separate iOS exploit kit designed for older operating systems (iOS 13.0 through 17.2.1). When combined into a single package, security researchers track the joint deployment as “DarkCoruna” or “DS-Fusion.”

Analysis of active threat infrastructure has uncovered several exposed operational hosts:

• 43.134.165[.]205: Serves DS-Fusion v1.0, combining DarkSword and Coruna payloads into a unified distribution package.
• 166.88.95[.]90: Functions as an active C2 server. Inspection revealed active Chinese iOS devices beaconing to this host every three seconds.
• 23.148.212[.]237: Serves as a developer staging environment where actors are actively constructing exploit chains targeting newer iOS releases, including CVE-2026-31001.
• 47.102.192[.]23 & 156.239.230[.]120: Host staging environments and C2 control panels exposing management endpoints.

While sophisticated groups are modifying source code directly, less experienced actors are attempting to deploy broken or non-functional GitHub leaks of these tools, often attempting to leverage Large Language Models (LLMs) to update the exploit code for iOS 26.x.

Mitigations and Response Actions

1. Update iOS Fleet: Ensure all managed Apple devices are updated past iOS 18.7. Newer iOS releases remediate the WebKit out-of-bounds write (CVE-2025-24201) and prevent sandbox escape chains used by DarkSword.
2. Audit Web Application Dependencies: Website administrators and e-commerce operators must inspect their site templates to remove legacy scripts referencing ecomtrack[.]io or unverified third-party analytics vendors.
3. Network Indicators: Block outbound communication to known distribution and C2 domains and IP addresses:
   • ecomtrack[.]io
   • chainmate[.]top
   • mertio.cc
   • 43.134.165[.]205
   • 166.88.95[.]90
   • 23.148.212[.]237
   • 47.102.192[.]23
   • 156.239.230[.]120