DarkSword P7 variant pulls Keychain and wallet data from iPhones

What happened

iVerify disclosed P7, a new variant of the DarkSword exploit kit. It extracts Keychain and crypto wallet data directly on the iPhone and keeps a two-way connection with the attacker's server.

The attack arrives as JavaScript on a web page; no app install is involved.

What was found

DarkSword was first documented by Google's Threat Intelligence Group, Lookout and others; Google says it works against iOS 18.4 to 18.7. It chains six vulnerabilities, including three zero-days (CVE-2025-43529, CVE-2025-14174 and CVE-2026-20700), and Apple fixed all six in iOS 26.3. How P7 reached victims was unclear at first; a later report traced it to malicious ads and expired web tags.

Data at risk

• Keychain data
• Crypto wallet data
• Seed phrases

What you should do

1. 1Update to iOS 26.3 or later.
2. 2If an older iPhone cannot be updated, avoid unfamiliar websites on it.
3. 3Do not store wallet seed phrases on your phone.