iPhone Spyware Polls Attacker Infrastructure Every 15 Seconds by Default, Can Scan Crypto Wallets

A newly identified iPhone spyware variant can poll attacker infrastructure every 15 seconds by default and scan for cryptocurrency wallet applications after an iPhone was infected, although no cryptocurrency theft has been confirmed.

The variant, called P7 DarkSword, was identified during an investigation into an iPhone infection in August 2026. The findings were published Oct. 8.

P7 includes a wallet_scan command that searches for installed wallet applications and a wallet_extract command that collects wallet-related data from imToken. Its /beacon request polls attacker infrastructure every 15 seconds by default, while a remote sleep command can change the interval.

The spyware can also collect Apple Keychain data, Apple Notes databases, photographs, installed-application information and selected app files. It prepares Keychain information as a JSON file on the compromised device before sending it elsewhere. Earlier DarkSword versions copied the Keychain database for processing outside the device.

P7 DarkSword is a post-compromise spyware variant within the DarkSword iOS exploit chain. The broader activity targeted iOS versions 18.4 through 18.7 and was observed in Saudi Arabia, Turkey, Malaysia and Ukraine through March 2026.

Apple released iOS 18.7.7 on March 24, 2026, and enabled additional device availability on April 1, 2026. The vulnerabilities associated with DarkSword had received fixes beginning in 2025.

The findings describe wallet and Keychain data-collection capabilities but do not establish that operators obtained private keys, stole cryptocurrency or executed unauthorized transactions. The number of affected devices, wallet users and any financial losses was not disclosed.