# New P7 DarkSword Spyware Targets iPhone Data and Credentials Sophisticated mercenary spyware variant exploits vulnerabilities to exfiltrate sensitive user information remotely. - **Source:** [Technology News Articles on Fox News](https://www.foxnews.com/tech) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/d392e947-71ab-474f-8445-3f137a1723e3 ## Discovery of P7 DarkSword Security researchers at iVerify identified a new variant of the DarkSword spyware family in August 2026. The discovery occurred while investigating unusual activity on a customer's iPhone. By utilizing the Validin threat intelligence platform, the team confirmed that attackers modified the code to enhance data collection capabilities and improve evasion during forensic investigations. ## Advanced Operational Mechanisms The P7 variant utilizes a command-and-control system capable of checking for new instructions every 15 seconds. Attackers can remotely adjust this interval to exfiltrate specific files or scan the device's file system. The malware injects its communication component into SpringBoard, a core process responsible for managing the iPhone's Home Screen and interface functions. ## Origins of Mercenary Spyware Apple confirmed that the original DarkSword technology originated from sophisticated mercenary spyware developed at significant expense. Following a leak, this advanced code became accessible to common criminals. The P7 prefix in the programming code distinguishes this specific iteration, which is designed to perform deeper data collection directly from the infected mobile device. ## Infection Vectors and Risks The spyware is associated with an iOS exploit chain often distributed through malicious advertisements or watering-hole attacks. Users browsing compromised websites may inadvertently trigger an infection if their device runs outdated software. While the malware targets sensitive documents and cryptocurrency wallets, researchers have not confirmed that it successfully compromises fully updated iPhone models. ## Patching and Software Updates Apple addressed the underlying vulnerabilities used by DarkSword in 2025, with additional security updates released in March 2026 for older devices. iPhones running the latest available software versions, ranging from iOS 15 through iOS 27, remain protected against these known exploits. Users should verify their current version via the Software Update settings menu. ## Mitigation Through Lockdown Mode For individuals facing advanced threats, Apple's Lockdown Mode provides a robust defense by restricting specific website technologies and messaging features. Security researchers confirmed that known DarkSword exploits fail to function when this mode is enabled. While it limits everyday functionality, it serves as a critical safeguard for users targeted by sophisticated malicious actors. ## Post-Compromise Security Steps If an iPhone compromise is suspected, users should change passwords using a separate, trusted device immediately. Contacting financial institutions is essential if unauthorized transactions appear. Users should avoid erasing the device prematurely, as resetting the phone can destroy forensic evidence required by specialists to determine the full extent of the security breach. ## Limitations of Security Apps Standard antivirus applications on iOS cannot perform the deep malware scans possible on traditional computers. These tools may fail to detect sophisticated spyware like P7 DarkSword, which actively hides its presence. Consequently, relying solely on security software is insufficient; maintaining updated iOS firmware remains the most effective defense against known malicious exploit chains. ## Strategic Security Outlook The emergence of P7 DarkSword highlights the risks associated with leaked mercenary-grade surveillance tools. As attackers refine their ability to remotely control infected devices, the reliance on regular software updates and proactive account security becomes paramount. Protecting personal data requires a combination of system hygiene, strong authentication, and vigilance against suspicious web content. ## Sources covering this story - https://www.foxnews.com/tech/new-iphone-spyware-steal-passwords-photos — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._