Unveiling the DarkSword Spyware Variant P7: Threatening the Security of Your iPhone

Recent findings suggest that the notorious DarkSword malware, initially exposed by cybersecurity experts earlier this year, is not only still prevalent but also undergoing significant evolution.

Unlike many other iPhone vulnerabilities, DarkSword posed a unique threat not just because of its capacity to launch attacks on unpatched iPhones, but also due to its accessibility to even the most inexperienced cybercriminals. Essentially, DarkSword functioned as a prepackaged hacking toolkit comprising HTML and JavaScript files that could be deployed effortlessly by simply hosting them on a web server.

Just recently, a deceptive “iPhone Duo Pre-Order” page emerged as a conduit for distributing DarkSword. Merely opening this page in Safari on an outdated iPhone or iPad was sufficient to contract the malware.

Fortunately, devices running iOS versions predating March 24, 2026, are considered “unpatched” in this context. Apple addressed the DarkSword threat in iOS 26.4, iOS 18.7.7, iOS 16.7.15, and iOS 15.8.7, alongside equivalent iPadOS releases. While prior iOS versions did not receive patches, the exploits exclusively targeted devices running iOS 13 or later, all of which are updatable to at least iOS 15.8.7.

Furthermore, these updates also remedied another exploit toolkit known as Coruna, which targeted devices operating on iOS 13 through iOS 17.2.1. DarkSword, on the other hand, specifically aimed at iPhones running iOS 18.4 through iOS 18.7, potentially leaving other versions vulnerable.

According to Google’s Threat Intelligence Group, DarkSword initially served the interests of “multiple commercial surveillance vendors and suspected state-sponsored actors” seeking to infiltrate the iPhones of users in Malaysia, Saudi Arabia, Turkey, and Ukraine.

Recently, iVerify uncovered a new iteration of DarkSword labeled P7. Fortunately, there is currently no evidence to suggest that this variant can compromise devices patched against earlier versions.

P7 DarkSword stands out primarily for being a newly discovered variant. iVerify first encountered it in August during an analysis of an infection on a client’s device. Upon examination, it was confirmed that this variant not only represented an unknown iteration but also a more refined version characterized by enhanced stealth, stability, and sophistication compared to its predecessors.

Significantly, while most DarkSword variants observed by security experts in recent months have been AI-generated, P7 DarkSword appears to have been meticulously crafted by human architects who invested considerable effort and demonstrated expertise in its modifications.

Apple’s existing defenses against DarkSword, encompassing iOS 18.7.7, iOS 26.4, and iOS 27, as well as subsequent versions, effectively shield against this threat. This underscores the importance of promptly installing iOS updates, as they typically address security vulnerabilities and thwart potential exploitation attempts.