Security researchers at the mobile security firm iVerify say they have discovered a more aggressive version of spyware capable of pulling passwords, photos and other sensitive data off infected iPhones. The malware, dubbed P7 DarkSword, is a new variant of an existing spyware family, and iVerify detailed its findings in an Oct. 8, 2026, report.
iVerify found the spyware while investigating a suspicious infection on a customer’s device in August 2026. After examining the phone with the customer’s permission, researchers determined that it behaved differently from earlier versions of DarkSword they had previously catalogued. Using the Validin threat intelligence platform, they then traced a related version of the code to separate, suspicious infrastructure.
The name P7 comes from a prefix attackers used in their own programming code. According to researchers, the modifications make the spyware more capable and harder for investigators to analyze. Apple told the outlet that DarkSword originated as sophisticated mercenary spyware built at considerable expense, and that after it leaked, the tool became available to ordinary criminals.
What the spyware can do
Once a device is compromised, P7 DarkSword can reach information most people consider private, including keychain data and cryptocurrency wallet information, according to researchers. It also uses a command-and-control system that can check for instructions from attackers every 15 seconds, an interval attackers can adjust remotely. The malware supports commands to scan a phone’s file system and execute JavaScript within its running environment.
Researchers also found that the spyware injects itself into SpringBoard, the core iPhone process that runs the Home Screen, and that attackers removed some diagnostic logging to make detection harder. iVerify did not conclude the malware is undetectable, and the findings describe the spyware’s capabilities without establishing that every category of data was actually stolen from the infected device under investigation.
How infection happens, and who’s at risk
DarkSword is linked to an iOS exploit chain that can compromise vulnerable iPhones through malicious web content, and researchers have tied the P7 variant to malicious advertisements and compromised websites. The original investigation does not fully establish how the customer’s phone was infected in the first place.
Earlier DarkSword attacks targeted iPhones running iOS 18.4 through 18.7. Apple says it patched the underlying vulnerabilities in 2025, before DarkSword first leaked, and issued a further security update in March 2026 for older devices unable to run newer iOS versions. Apple says iPhones running the latest available update for iOS 15 through iOS 27 remain protected against the known DarkSword exploits. Researchers found exploit components tied to iOS 18.7 in the newer P7 investigation, but have not confirmed the spyware can compromise a fully updated iPhone.
How to protect your device
Security researchers and Apple point to several basic steps iPhone owners can take:
- Check Settings > General > Software Update to confirm you’re on the latest available version for your device, and turn on Automatic Updates.
- On iOS 27, enable Background Security Improvements, which provide added protection between major software releases.
- Avoid opening unexpected links in texts or emails, particularly messages pressuring quick action.
- Consider Apple’s Lockdown Mode if you believe you could be a specific target of sophisticated surveillance. Apple says security researchers have confirmed the known DarkSword exploits do not work on devices with Lockdown Mode enabled.
- Use a passcode, a strong unique password and two-factor authentication for your Apple Account, and install apps only from the App Store.
Apple also recommends using a password manager, though it cannot protect credentials already exposed by an active infection. If you have credible evidence your iPhone was compromised, Apple advises changing important passwords from a separate, trusted device, contacting your bank about any unauthorized transactions, and seeking trusted assistance before moving cryptocurrency funds.
A phone running advanced spyware may show no outward symptoms, so normal battery life or the absence of pop-ups doesn’t prove a device is clean. If you receive what looks like an Apple threat notification, verify it by logging in directly at account.apple.com rather than clicking any link in the message, and consult a qualified mobile security specialist rather than immediately resetting the phone, since a factory reset can destroy evidence investigators would need.
