DarkSword Spyware Poses Danger on iPhone

Security researchers have discovered a new and advanced DarkSword spyware variant P7 targeting iPhone devices. Here's what you need to know about the new cyber threat.

Security firm iVerify has announced the emergence of P7 DarkSword, a new and more advanced variant of the previously detected DarkSword spyware. This new threat, discovered on the iPhone device of a financial institution employee in August, provides access to sensitive data by targeting outdated software. While P7 DarkSword has the ability to work much more stealthily than its previous versions, it contains dangerous features such as stealing crypto wallet data and gaining full control over the device. Experts seriously warn users that attackers spread this software through malicious ads.

Cyber Attackers Are Improving Their Strategies

According to technical reviews by iVerify, the P7 DarkSword variant is not just a code update but also an operational evolution. While previous DarkSword attacks generally focused on one-way data leakage, the P7 version offers a two-way system that sends reports to the center every 15 seconds and can receive instant commands. This makes it easier for cybercriminals to gain full control over Apple Notes, photo galleries and app data on the device.

The most striking aspect of the attack is that the data is processed directly on the device and the Keychain data is exported. This method makes it difficult for traditional security software to detect the leak. Additionally, the P7 version uses the device's resources more efficiently and does not cause a noticeable slowdown in system performance, making it difficult for users to understand that their device is infected.

Watering-Hole Attacks Are Becoming Common

P7 DarkSword's distribution method is based on a "watering-hole" strategy that covers large audiences rather than focusing on specific targets. Users may automatically encounter this threat only when they visit websites that appear trustworthy but contain malicious content. This method allows attackers to create a mass infection network rather than individual targets.

Security experts emphasize that the most effective way to protect against such attacks is to always keep the operating system in the most up-to-date version. Although Apple has released iOS updates against DarkSword threats, users who do not update their devices remain vulnerable to such modern spyware variants.

Users Should Increase Their Precautions

With the detection of P7 DarkSword, old indicators of security (IOC) became obsolete. iVerify states that the software is quite successful in cleaning up its own behavior. Therefore, it is critical that users do not click on suspicious links and update their security scans whenever they notice unusual activity on their devices.