Security researchers have identified a more dangerous version of iPhone spyware capable of pulling passwords, photos and other sensitive data off infected devices, then maintaining ongoing contact with the attackers who planted it.
The spyware, called P7 DarkSword, was discovered by researchers at mobile security firm iVerify while investigating an infected iPhone. In an Oct. 8, 2026, report, the firm said the malware can collect sensitive information and receive further commands from attackers after infection. The research does not show that every iPhone is at risk, and it stops short of proving the spyware can compromise a fully updated device.
How it was found
iVerify’s security system flagged unusual activity on a customer’s phone in August 2026. With the customer’s permission, researchers examined the device and found the spyware behaved differently from earlier versions of DarkSword, an existing spyware family. Using the Validin threat intelligence platform, they traced a related version hosted on suspicious infrastructure. The name P7 comes from a prefix used in the attackers’ code.
Apple told the outlet that DarkSword originated as expensive, sophisticated mercenary spyware. After it leaked, the tool became available to ordinary criminals.
What the spyware can do
According to iVerify, P7 DarkSword uses a command-and-control system that can check in with attackers as often as every 15 seconds, an interval attackers can adjust remotely. It can scan a phone’s file system and run JavaScript within the device’s operating environment. Researchers say it injects itself into SpringBoard, the core iPhone process that runs the Home Screen, and removes some diagnostic logging to make detection harder — though iVerify did not say the spyware is undetectable.
The malware can reportedly reach keychain data and cryptocurrency wallet information, among other sensitive material. iVerify’s findings describe the spyware’s capabilities but do not establish that attackers successfully extracted every category of data from the infected device they examined.
How infection happens — and who’s protected
DarkSword has been linked to an iOS exploit chain delivered through malicious web content, including malicious ads and compromised
Add comment