DarkSword iOS Exploit Kit: 5 C2 Hosts Exposed as P7 Variant Adds LLM-Assisted Update Attempts
iVerify has disclosed P7 DarkSword, a new variant of the DarkSword iOS exploit kit that adds keychain and crypto-wallet theft and two-way C2, while Censys exposed five hosts running the kit's exploitation-as-a-service platform. Researchers also observed multiple unsuccessful, likely LLM-assisted attempts to update the kit for iOS 26.x.
Mobile security company iVerify has disclosed "P7 DarkSword," a previously unseen variant of the DarkSword iOS exploit kit that reduces its on-device footprint, adds keychain and crypto-wallet theft, and, according to reporting published on October 9, 2026 by The Hacker News, has been the target of multiple unsuccessful, likely LLM-assisted update attempts observed in the wild as recently as September 2026. The disclosure arrives alongside separate research from Censys, which identified open directories on five hosts carrying DarkSword and its companion payload kit Coruna, including a command-and-control platform that recorded two real Chinese iOS devices beaconing on September 6, 2026.
What was the specific vulnerability?
The specific vulnerability is a chained exploit kit that uses two previously undocumented CVEs to escape the iOS browser sandbox, escalate to kernel privileges, and inject an implant into SpringBoard, Apple's home-screen process. According to The Hacker News, the kit exploits CVE-2025-24201, a WebKit out-of-bounds write used for sandbox escape, fixed in iOS and iPadOS 18.3.2, and CVE-2025-31200, a Core Audio memory corruption flaw leading to code execution, fixed in iOS and iPadOS 18.4.1. The implant polls for commands every 15 seconds and supports commands including execute_command, download, photos, wallet_scan, wallet_extract, memo_scan, photo_scan, disk_scan, and exec, the last of which runs arbitrary JavaScript in the implant runtime. The wallet_extract command targets the imToken wallet app. In its own disclosure, iVerify stated: "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure."
How was the incident detected?
The incident was detected through two independent research efforts: iVerify's analysis of the new P7 variant and Censys's scanning for exposed attacker infrastructure. iVerify disclosed the variant in a report published on October 8 and 9, 2026. According to Censys, open directories were identified on five hosts: 43.134.165[.]205, which serves a DS-Fusion v1.0 bundle; 166.88.95[.]90, a C2 server that recorded two real Chinese iOS devices, 183.154.173[.]30 and 182.239.114[.]223, polling every three seconds for several hours on September 6, 2026; 23.148.212[.]237, an analysis workspace showing an operator developing exploit chains for iOS 26; 47.102.192[.]23, used for Coruna staging; and 156.239.230[.]120, a full C2 platform observed polling a device on September 15, 2026. DarkSword itself was first publicly documented in March 2026 by Google Threat Intelligence Group, iVerify, and Lookout, and was first detected in the wild in November 2025.
What is the current impact?
The current impact is confirmed victim activity and exposed stolen data, with the underlying device vulnerabilities patched but the attacker infrastructure partially live. According to Censys researcher Aidan Holland, quoted by The Hacker News: "The platform runs a Chinese-speaking exploitation-as-a-service operation. The admin panel exposes an agent/reseller model, and a copy of the production server recovered 11 victim recovery phrases, 179 device loot directories, and a 75-account control-plane roster." Coruna's wallet-harvesting modules steal crypto recovery phrases, balances, and keystore data from iOS apps. Stolen data more broadly includes keychain contents, iCloud Keychain information, Apple Notes, Photos, and cryptocurrency wallet data. A separate China-based operator ran the same kit against its own C2 at "66ds[.]lol," adding BitKeep as a wallet target, with hosting on Tencent and Shenyang infrastructure tied via a unique self-signed certificate authority. Prior DarkSword usage includes attacks targeting Saudi Arabia, Turkey, Malaysia, and Ukraine by multiple actors, including the Turkish commercial surveillance vendor PARS Defense through a fake Snapchat-themed website and the Russia-aligned Star Blizzard/COLDRIVER through fake invitation lures. Attribution for the current operation is unconfirmed, with a Chinese-speaking actor suspected.
What are the next steps?
The next steps are for iPhone users to confirm they run patched iOS versions and for defenders to monitor the identified infrastructure, while researchers track the LLM-assisted development activity. Apple has already fixed both exploited vulnerabilities in iOS and iPadOS 18.3.2 and 18.4.1, so devices on current versions are not exposed to this specific chain. According to iVerify, as recently as September 2026 it observed "multiple unsuccessful, likely LLM-assisted attempts to update the framework to support iOS 26.x," fueled by the leak of the exploit kit shortly after its public disclosure, and the new variants focus on "stability, stealth, and quality of stolen data." The C2 infrastructure remains partially live and observable, and the open directories identified by Censys continue to expose operator tooling, including the iOS 26 development workspace on 23.148.212[.]237.