New iPhone spyware can hunt for crypto wallets and extract their data every 15 seconds

A newly discovered variant of iPhone spyware has been identified by researchers, featuring the ability to remotely pull sensitive credentials and cryptocurrency wallet data from infected devices.

Security organization iVerify made the malware public—named P7 DarkSword—on Oct. 8 following an analysis of an infection spotted in August. The specific variant features commands aimed at cryptocurrency wallet applications, alongside the capacity to harvest personal files, photos, and passwords.

This finding underscores a growing danger for mobile crypto asset holders: threat actors who breach the host device can siphon private information without needing to compromise the wallet application itself.

How the spyware targets cryptocurrency wallets

Based on the technical findings from iVerify, P7 incorporates two distinct routines to locate and harvest crypto-related assets.

The first function, wallet_scan, scans compromised handsets to spot installed wallet software, helping operators pinpoint lucrative targets.

The second function, wallet_extract, focuses on gathering data linked to imToken, a multi-chain cryptocurrency wallet.

Working in tandem, these commands empower attackers to detect crypto users and extract files tied to their wallets once system access is achieved.

Additionally, the spyware zeroes in on Apple’s Keychain, which holds authentication data, passwords, and other confidential records.

Whereas older iterations of DarkSword duplicated the Keychain database and shipped it off to command-and-control servers for processing, P7 handles this differently.

Instead, P7 formats the targeted Keychain details straight into a JSON file right on the infected device prior to transmission.

This shift alters the credential-harvesting workflow, potentially supplying operators with immediately actionable intelligence the moment the data arrives at their servers.

The threat goes beyond dedicated crypto wallet apps.

P7 is also capable of harvesting image galleries, Apple Notes databases, and select app files. These repositories frequently harbor recovery phrases or wallet credentials if users unwisely save them there.

That said, simply acquiring wallet data or identifying an installed application does not grant automated dominance over private keys. Any unauthorized transfer relies heavily on the exact data successfully retrieved and whether it suffices to authorize transactions.

A more significant evolution lies in the malware’s enhanced remote-management functionality.

Rather than depending entirely on rigid collection routines, P7 checks in with an attacker-managed server every 15 seconds by default to fetch new instructions to run on the compromised phone.

Operators can modify this polling frequency, hunt for targeted files, and trigger further data-harvesting tasks without needing a fresh device compromise.

Investigators also documented changes designed to boost reliability and evade detection.

Modifications include scaling back process injections, stripping out certain diagnostic logs, and leveraging browser storage to circumvent recurrent exploitation cycles that might otherwise crash the phone.

These adjustments signal a pivot toward persistent, highly focused data collection, which could grant adversaries prolonged visibility into a victim’s financial movements following an intrusion.

Even so, iVerify stopped short of publishing proof of successful cryptocurrency thefts, specifying the exact volume of affected wallet users, or calculating total financial losses.

Apple’s earlier security fixes face an evolving threat

This disclosure arrives on the heels of ongoing measures to neutralize DarkSword, an iPhone exploit framework previously leveraged by various surveillance vendors.

In March, the Threat Intelligence Group at Google revealed that DarkSword leveraged a chain of six vulnerabilities to breach iPhones operating on specific builds of iOS 18.4 through 18.7.

Google’s findings highlighted campaigns linked to commercial surveillance merchants alongside state-sponsored groups targeting individuals in Turkey, Ukraine, Saudi Arabia, and Malaysia.

That framework enabled malicious actors to target devices via weaponized web content before installing payloads capable of siphoning personal and financial information, including crypto wallet records.

However, P7 represents a post-compromise evolution of the malware rather than proof of a brand-new flaw in Apple’s mobile platform.

Apple has already deployed patches for the vulnerabilities connected to the recorded DarkSword exploitation vector.

Official security documentation notes that the relevant mitigations first rolled out in 2025.

To secure devices running legacy operating system versions, Apple subsequently pushed out iOS 18.7.7 on March 24, 2026, widening availability on April 1.

These defenses remain critical because the tactics flagged by iVerify rely on attackers already breaching the hardware.

The October analysis does not confirm that P7 can sidestep the latest iOS patches, and researchers did not share a variant-specific breakdown highlighting which updated versions remain exposed.

Nevertheless, Apple advises users to maintain up-to-date software and enable automatic updates, while Google’s prior research on DarkSword also suggested turning on Lockdown Mode when immediate patching is not an option.

?Frequently Asked Questions

01What is P7 DarkSword?

P7 DarkSword is a newly discovered iPhone spyware variant that can remotely extract cryptocurrency wallet data, credentials, and personal files from compromised Apple devices.

02How does the P7 spyware target cryptocurrency wallets?

It utilizes specific commands such as wallet_scan to locate installed wallet apps and wallet_extract to pull data from multi-chain wallets like imToken every 15 seconds based on its remote-control polling interval.

03Does the spyware bypass Apple’s latest security updates?

Researchers have not confirmed that P7 can bypass current iOS patches, as the malware depends on an initial device compromise. Apple recommends applying the latest software updates to protect against related exploits.