iVerify disclosed a new variant of the DarkSword iOS exploit chain on 8 October, having first seen it in August. It calls the variant P7, after a variable prefix the operator left through its modifications to the original code.

The technical changes are real but ordinary. The interesting part is how it is being delivered.

From targeted tooling to an advert

The original DarkSword chain was documented in March 2026 by Google's Threat Intelligence Group, working with Lookout and iVerify. That is the shape of a targeted capability: a zero-click browser chain, found on specific people's phones, written about by the organisations that investigate state-aligned intrusions.

Then, iVerify says, the source code was leaked by a third party after the chain was publicly disclosed.

P7 is what came next. It is distributed through malicious adverts as part of watering-hole attacks — meaning the victims are not necessarily individually chosen. They visited a page. iVerify first saw it on the iPhone of an employee at a financial institution.

That is the whole story in one line: a capability that existed to surveil selected people is now being sprayed at whoever loads an ad, and what it takes is money.

The infection needs no tap and no download beyond the visit itself.

What it takes off the phone

The payload has been rebuilt around a different goal.

Rather than copying the keychain database off the device for later processing, P7 extracts keychain data into JSON on the phone before exfiltrating it — a smaller footprint and less to notice. It adds two-way command and control, where the earlier version mostly reported.

The command set, as iVerify describes it: poll for instructions every 15 seconds, send a heartbeat, send the list of installed applications, and transmit iCloud Keychain contents along with data from Apple Notes, Photos, and cryptocurrency wallets.

Two commands are specifically about wallets. One checks which wallet apps are installed. The other extracts data from imToken.

A chain that cost real money to develop, pointed at the contents of a phone's keychain and whatever wallet happens to be on it. That is a change of business model, not of capability.

This is the second time in a fortnight we have written about tooling built to harvest recovery material from crypto users — sixteen Firefox extensions that were the real wallet's code with the import function hooked was the other. Different platform, same target.

Patched phones appear to be fine

The actionable fact, and iVerify is clear about it: no evidence that P7 can compromise patched devices.

Most coverage puts the targeted range at iOS 18.4 through 18.7, with one account describing P7 as extending compatibility to 18.7 from 18.6 in the variant previously tracked. One outlet names specific builds as unaffected; we have not been able to check that against iVerify's own report, so we are not repeating the numbers.

The practical version is unglamorous and complete: this is a chain against versions that have been superseded. Update the phone.

The advert is the part that scales

Malvertising is worth looking at on its own, because it is the piece that turns a capability into a business.

The operator does not pick targets. They buy or compromise a placement, and the network delivers it to whoever the network decides should see it. Targeting, such as it is, comes from the ad platform's own audience segments — which means an attacker can approximate "people who read cryptocurrency sites" without ever identifying a person.

For a defender that breaks the usual advice. You cannot train somebody out of visiting a page they had every reason to visit, and the malicious code did not come from that page's publisher. It came from an ad slot the publisher sold to a network that resold it onward, through a chain that nobody in the transaction audits end to end.

It also explains the victim here. A financial institution's employee was not chosen. They loaded a page.

What this says about disclosure

Nobody did anything wrong in the sequence that produced P7. A chain was found, investigated, written up and patched — which is how it is supposed to work, and the write-up is why defenders could detect it at all.

But publication is also a specification. Once the chain is described and the code is loose, the remaining barrier is not knowledge; it is the cost of building, and that has already been paid. What was a tool for a handful of targets becomes a commodity for whoever rents the ad slot.

That is an argument for patching faster rather than for publishing less. The window between disclosure and commodity use is the thing that keeps shortening, and the only part of it a defender controls is their own update cycle.

What to do

  • Update iOS. On the reported evidence that is sufficient, and nothing else here is.
  • If a phone was on an affected version and used for cryptocurrency, treat wallet credentials and the iCloud Keychain as exposed. Move the assets from a clean device and reissue what was stored.
  • Content blockers reduce exposure to malvertising, which is the delivery route here rather than a link somebody sent.
  • For organisations: this reached a financial-sector employee's phone through an advert. Mobile device compliance that only checks for jailbreaks will not see it.

What is not established

  • Which vulnerabilities make up the chain. CVE identifiers appear in some coverage; we have not verified them against iVerify or Google.
  • The exact unaffected build numbers.
  • How many devices were infected, and over what period.
  • Who is operating P7, and whether they are the same party that leaked the source.
  • Whether wallet applications other than the one named are targeted by builds not yet seen.