iPhone Spyware Targets Crypto Wallets, Checks In Every 15 Seconds

Security firm iVerify disclosed P7 DarkSword on Oct. 8 after investigating an iPhone infection detected in August. The spyware searches for cryptocurrency wallets, collects device data and communicates with an attacker-controlled server every 15 seconds by default.

P7 includes two commands aimed at crypto users. The wallet_scan command searches for installed wallet apps. The wallet_extract command collects data linked to imToken, a wallet that supports multiple blockchain networks.

The spyware can access Apple’s Keychain, which stores passwords, authentication credentials and other sensitive data. Earlier DarkSword versions copied the Keychain database and sent it to attacker-controlled servers. P7 converts the collected information into a JSON file on the iPhone before sending it.

P7 can also search Apple Notes databases, photos and selected application files. These locations may contain recovery phrases, wallet credentials or financial records. Finding a wallet app or obtaining its files does not by itself give an attacker control of the wallet. Unauthorized transactions would depend on whether the stolen data could authorize transfers.

The spyware can receive new instructions from its operators after an initial compromise. Operators can change the connection interval, search for specific files and order more data collection without infecting the device again. iVerify also found fewer diagnostic logs, reduced process injections and browser storage designed to prevent repeated exploitation attempts from destabilizing the phone.

iVerify found no evidence of completed cryptocurrency theft. The company did not disclose the number of affected wallet users or estimate financial losses. Its investigation also did not establish whether P7 can compromise iPhones running the latest security updates.

P7 is linked to the broader DarkSword exploitation framework. Google researchers reported in March that the framework used six vulnerabilities to compromise certain iPhones running iOS 18.4 through 18.7. Earlier campaigns targeted users in Saudi Arabia, Turkey, Malaysia and Ukraine and involved commercial surveillance vendors and suspected state-backed attackers.

Those attacks used malicious web content to compromise vulnerable devices before installing software that could collect personal and financial information, including cryptocurrency wallet data. P7 is spyware deployed after a successful compromise, not evidence of a newly discovered Apple operating-system vulnerability.

Apple has released fixes for the vulnerabilities linked to the documented DarkSword attack chain. Its security advisory lists protections first available in 2025. Apple released iOS 18.7.7 on March 24, 2026, and extended its availability to additional devices on April 1. Apple recommends installing the latest compatible software and enabling automatic updates. Google recommends Lockdown Mode for users who cannot update their devices.