In short: On October 8, 2026, iVerify published findings on a new iPhone spyware strain, P7 DarkSword — an upgraded modification of the known DarkSword exploit kit. Infection requires no app install: it spreads through malicious advertising and compromised websites (watering-hole attacks). The malware steals keychain passwords, photos, notes, and crypto-wallet data, checking in with its control server every 15 seconds. Vulnerable devices run iOS 18.4 through 18.7; Apple closed the hole with the 18.7.7 update.
One telltale early sign of spyware infection is a sudden spike in background data and battery use, covered in our guide on signs your phone has been hacked. If your iPhone is behaving that way, start your check there.
What iVerify's researchers found
iVerify identified P7 while investigating an infection on a financial-institution employee's device in August 2026, publishing results on October 8. The name P7 comes from the p7_ variable prefix attackers used in their modified version of the original DarkSword code. Compared to earlier variants, P7 noticeably reduces its on-device footprint and adds two-way communication with its command-and-control infrastructure.
How infection happens — no app install required
P7 spreads through malicious advertisements in watering-hole-style attacks: victims aren't individually targeted, they simply encounter an infected ad or compromised site while browsing normally. Simply loading the specially crafted web content is enough to trigger the exploit — no manual installation step is needed.
What P7 DarkSword actually steals
According to the investigation, the malware extracts iOS keychain data directly on-device, information about installed crypto wallets (imToken is specifically named), photos, the contents of Apple Notes, the list of installed apps, and data inside individual app containers. Communication with attacker infrastructure is two-way: by default the malware checks in every 15 seconds (an interval attackers can adjust remotely), letting an operator request specific files or issue commands in real time.
Who's at risk and which iOS versions are vulnerable
The exploit works on iOS 18.4, 18.5, 18.6, and 18.7 — any device that hasn't updated to the patched release. Because distribution runs through ad networks and compromised sites rather than targeted phishing, anyone with an outdated iPhone is at risk, not just journalists or activists typically targeted by spyware of this caliber.
How to protect yourself
- Update your iPhone to iOS 18.7.7 or later (18.7.7+, or 26.4 and above on current lines); Apple closed this hole with that patch on March 24, 2026.
- Enable Lockdown Mode in privacy settings if you're at elevated risk (journalist, activist, employee with access to company crypto assets) — it disables some features but sharply narrows the attack surface.
- Avoid tapping suspicious banners and pop-ups in the browser, especially on unfamiliar sites — that's exactly how P7 spreads.
- Review which apps have access to your Keychain and crypto wallets if you suspect infection; general account-recovery steps are covered in our guide on protecting an account from a hack.
- For how to spot infostealers and how they differ from classic spyware, see our article on infostealers and password theft.
A VPN doesn't patch the underlying iOS flaw and won't stop an exploit that fires when a compromised page loads — only the firmware update does that. But encrypting your traffic with LiMP VPN reduces the risk of malicious ads being swapped in on your specific connection over an unsecured network, like a café or airport — details on the pricing page.