Security researchers have identified an iPhone spyware strain called P7 DarkSword that hunts for cryptocurrency wallet apps and pulls wallet related data from devices that have already been compromised. According to iVerify, this malware is an upgraded variant that can recognize crypto wallet users and extract information from the imToken wallet. It uses wallet_scan and wallet_extract commands to target imToken files every 15 seconds, and it frequently contacts an attacker controlled server so operators can send new instructions without exploiting the phone again. This design makes surveillance continuous and stealthy after the initial compromise.
P7 DarkSword is not described as a brand new universal iOS vulnerability. Reports indicate it is a tool used after an iPhone has already been exploited through a broader DarkSword attack chain aimed at specific iOS versions and regions. Apple has since patched the related vulnerabilities in newer releases. Even so, those protections only help users who install the updates.
The current risk is serious but not fully confirmed as a theft campaign. Reports say the spyware can harvest Apple Keychain data, Notes databases, photos, and selected app files. Any of these could contain recovery phrases, passwords, or other wallet credentials. However, researchers have not confirmed a case of stolen cryptocurrency or proven extraction of private keys. Infections were observed starting in early 2026. Associated fixes include an iOS 18.7.7 update and earlier patches. Once an iPhone is compromised, wallet data stored on it or generated by it should be considered exposed, even if attackers have not acted yet.
For iPhone users who hold crypto, practical protection starts with device integrity. Keep iOS on the latest version and consider Apple’s hardened modes, especially if immediate updating is not possible. Google’s threat team also recommended these hardened settings for users who cannot update right away. Unexplained mobile device management enrollment, strange configuration profiles, or unusual phone behavior should be treated as red flags. If any of these appear, stop using that device for crypto activity.
If infection is suspected, the safer path is to migrate funds to a new wallet created on a different and trusted device with a fresh recovery phrase. Avoid storing seeds or credentials in Notes, photos, or general purpose apps. Treating a compromised phone as a compromised wallet is conservative, but it is also realistic. Crypto is only as safe as the phone it lives on.
The discovery of P7 DarkSword shows that attackers are now explicitly targeting mobile crypto users by scanning for wallet apps and harvesting surrounding data after an iPhone is compromised. No confirmed theft has been linked to this spyware yet, but the case reinforces a broader trend. Wallet security depends not only on choosing a good app, but also on using a fully trustworthy device, a clean operating system, and disciplined handling of recovery phrases and credentials. For anyone using an iPhone for self custody, the main safeguard is maintaining device integrity and being ready to move to a clean setup at the first credible sign of compromise.
