New iPhone Spyware Steals Crypto & Notes!

Researchers have uncovered a more aggressive variant of iPhone spyware, dubbed P7 DarkSword, capable of targeting highly sensitive user data. This advanced malware can extract saved credentials from the iPhone's keychain, potentially compromising accounts. It is also designed to search for and extract information from cryptocurrency wallet applications, specifically noting a function targeting the imToken app.

Further capabilities of P7 DarkSword include accessing personal photos and copying Apple Notes databases, exposing private information stored by users. The spyware communicates with its operators frequently, checking for commands every 15 seconds, allowing for remote control and expanded data collection. Attackers modified the code to be more effective and harder to investigate.

This spyware family is linked to an iOS exploit chain, distributed through malicious advertisements and compromised websites. While earlier DarkSword attacks targeted specific iOS versions, Apple states that vulnerabilities exploited by known attacks were patched before the spyware leaked. iPhones running the latest available updates for iOS 15 through iOS 27 remain protected against these known exploits.

To mitigate risks, users are advised to install the latest iPhone security updates promptly. Enabling Background Security Improvements on iOS 27 and considering Apple's Lockdown Mode offer additional layers of protection. Users should also exercise caution with unfamiliar websites, use strong passwords, and enable two-factor authentication for their Apple Account.