P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Theft and Remote Commands

P7 DarkSword is an iOS exploit kit whose newest variant, reported on 2026-10-10 via thehackernews.com and cyberupdates365.com, shrinks its on-device footprint while adding on-device keychain extraction, crypto-wallet data theft, and two-way command-and-control. The events carry no CVE assignment and no victim counts, but the mechanism is specific: a mobile exploit kit that targets both credential storage and cryptocurrency wallets and opens a remote channel instead of relying solely on local payload execution. That pairing implies a targeted victim profile - users who maintain both sensitive accounts and digital assets on the same device - and the reduced footprint suggests an evolution toward stealth over persistence, making signature-based detection harder.

The story matters because mobile exploit kits rarely combine credential and crypto-theft objectives in a single update; doing both in a smaller package raises the economic yield per infection without increasing visibility. Only two sources cover it (original event masto:117414269144783786 at 2026-10-10T02:32:45Z, update masto:117414154109842664 at 2026-10-10T02:03:30.516Z), and neither assigns a CVE or lists affected versions. A defender should treat this as an emerging mobile C2 threat rather than a known patch-available vulnerability, because without version or patch data, network-level detection and behavioral hunting become the primary controls.

Concrete actions: hunt iOS device telemetry for unexpected outbound connections matching the two-way C2 pattern described in the original event; inspect mobile endpoint logs for keychain-access anomalies or wallet-app interaction spikes; and restrict mobile device network access to known-good endpoints until the vendor advisory or CVE details are published. The events mention crypto-wallet theft and remote commands explicitly - use those terms as IoC keywords in SIEM rules rather than inventing file names or registry paths not present in the source.

Watch for a vendor advisory assigning a CVE and listing affected iOS versions or patch levels, and for any GreyNoise-style telemetry confirming in-the-wild exploitation. Either development would shift this from a single-source emerging-threat observation to an actionable vulnerability with defined remediation scope.