A new DarkSword spyware variant targets old iOS 18, and updates stop it
iVerify found a stealthier DarkSword implant that steals keychain data; Apple's earlier patches still block it.
Apple · Macfolio · 11 October 2026
Mobile security firm iVerify published a report on October 8 describing P7 DarkSword, a new version of the spyware delivered by the DarkSword iPhone exploit chain. iVerify found it in August 2026 while investigating an infection on a customer's iPhone. 9to5Mac reported that the device belonged to an employee at a financial institution.
What iVerify found
DarkSword is a web-based attack chain that researchers disclosed in March. It targets iPhones running iOS 18.4 through iOS 18.7. P7 is not a new iOS vulnerability. It is a reworked implant that runs after the existing chain compromises a phone.
- Name: from the "p7_" prefix in the attackers' added code
- Runs inside: SpringBoard, the iPhone's Home Screen process
- Steals: keychain data, crypto-wallet data, Apple Notes, photos, files, and an app list
- Check-in: polls attacker servers every 15 seconds by default
- Delivery: malicious ads and compromised websites, per iVerify's comments to 9to5Mac
iVerify says P7 removes debug logging and reduces process injections, so older indicators of compromise may no longer catch it. The report includes new domains and file hashes.
What Apple has already shipped
Apple's security note for iOS 18.7.7, released March 24, says Apple widened its availability on April 1 to protect more devices from "web attacks called DarkSword," and that the related fixes first shipped in 2025. Apple's support guidance says devices with updated software were not at risk from these attacks, and that Lockdown Mode also blocks them on out-of-date software.
Current releases are iOS 27.0.1 and iOS 26.7.1 from September 28, and iOS 18.7.10 from August 17 for iPhone XS, XS Max, XR, and iPad (7th generation).
This does not mean current iPhones are exposed, or that Macs are affected.
Our take: this is a patch-compliance story, not a new emergency. If you manage iPhones that access work email or banking apps, check your MDM inventory for anything on iOS 18 below 18.7.7 and require an update. Block unmanaged phones until they update.
iVerify did not say how many devices are infected, and Apple has not commented on P7 specifically.