Researchers Discover New iPhone Spyware That Can Steal Passwords and Crypto Wallet Data

Cybersecurity researchers have identified a new variant of iPhone spyware called P7 DarkSword, which can secretly collect sensitive information from compromised devices and allow attackers to issue commands remotely. The discovery was announced by mobile security company iVerify on October 8, 2026, following an investigation into an infected iPhone belonging to an employee at a financial institution. Researchers said the malware represents an evolution of the previously identified DarkSword spyware family, with improvements designed to make it harder to detect and more effective at extracting personal information. The discovery adds to growing concerns that sophisticated mobile surveillance tools are increasingly being adapted for broader criminal use rather than remaining exclusively in the hands of government intelligence agencies.

According to the researchers, P7 DarkSword can target several categories of sensitive information stored on an infected iPhone. These include data from Apple’s Keychain, which stores passwords and other credentials, photographs, Apple Notes databases, installed application information and selected files. The spyware can also target cryptocurrency wallet information, potentially exposing users to financial losses if attackers obtain the necessary credentials or other sensitive data. Researchers further reported that the malware can communicate with its operators’ command-and-control infrastructure, allowing attackers to request additional information after a device has been compromised. However, these findings describe what the spyware is capable of doing; they do not establish that every infected device has had all its information stolen.

One particularly concerning feature is the malware’s improved ability to remain hidden. iVerify reported that P7 DarkSword reduces its on-device footprint and limits certain activities that might otherwise make suspicious behaviour easier to identify. The variant also performs some data extraction directly on the device, rather than relying on the same methods used by earlier versions. Researchers said these modifications make older indicators of compromise less reliable when investigating potential infections. The spyware was reportedly distributed through malicious advertisements and compromised websites, a technique sometimes described as a watering-hole attack. This means that people could potentially encounter harmful content while browsing online without being individually selected as targets or deliberately downloading an application.

The discovery follows earlier investigations into DarkSword and another iPhone hacking tool known as Coruna. In March 2026, researchers from Google, iVerify and Lookout reported that DarkSword had been used in attacks involving vulnerable iPhones, with campaigns observed in countries including Ukraine, Saudi Arabia, Turkey and Malaysia. The earlier investigations found that attackers could exploit weaknesses in outdated versions of Apple’s operating system to gain access to sensitive information. Researchers warned that sophisticated exploitation techniques were becoming more widely available, increasing the possibility that tools originally associated with state-linked surveillance could also be used by financially motivated criminals. Apple has released security updates addressing the underlying vulnerabilities associated with earlier DarkSword attacks, although devices that have not received the relevant fixes may remain exposed.

Security experts are advising iPhone users to install the latest iOS updates available for their devices and avoid delaying important security patches. Users should also be cautious when browsing unfamiliar websites, interacting with suspicious advertisements or opening unexpected links. People who suspect that their devices may have been targeted should consider seeking help from a reputable cybersecurity professional, particularly if their phones contain sensitive business information or cryptocurrency assets. Updating an iPhone substantially reduces exposure to known vulnerabilities, although no single measure guarantees complete protection against every possible attack. The emergence of P7 DarkSword demonstrates that smartphone security threats continue to evolve, making regular software updates and careful digital habits essential. Researchers have not established that every iPhone is affected, but the findings reinforce the importance of protecting devices against increasingly sophisticated spyware.