Malware
P7 DarkSword iOS Exploit Kit Adds Keychain Theft and Remote Command Capability
A new P7 variant of the DarkSword iOS exploit kit has been identified, featuring a smaller on‑device footprint, on‑device keychain and crypto‑wallet theft, and two‑way command and control. The kit targets iOS 18.4–18.7 and has been used in campaigns across Saudi Arabia, Turkey, Malaysia, Ukraine, and by a Chinese‑speaking actor. Defenders should update iOS, enforce app‑whitelisting, and monitor for suspicious network traffic to mitigate the threat.
What happened
Security researchers uncovered P7 DarkSword, a new variant of the DarkSword iOS exploit kit. Compared to earlier versions, P7 reduces its on‑device footprint, adds theft of keychain and crypto‑wallet data, and introduces two‑way command‑and‑control (C2) communication with the attacker’s infrastructure.
Impact
P7 targets iOS 18.4–18.7, chaining multiple vulnerabilities to escape the browser sandbox, gain kernel privileges, and inject code into SpringBoard. It has been deployed in attacks against users in Saudi Arabia, Turkey, Malaysia, Ukraine, and by a Chinese‑speaking threat actor that also served an Apple‑ID decoy sign‑in page. Victims may lose credentials, crypto‑wallet balances, and other sensitive data.
What to do
- Ensure all iOS devices run the latest iOS version (≥18.7) and apply all security updates promptly.
- Implement device‑management policies that restrict installation of unknown or sideloaded apps.
- Use network segmentation and monitor outbound traffic for unusual connections to known malicious C2 domains.
- Educate users to avoid phishing sites, especially those mimicking popular apps or services.
- Consider disabling keychain sharing for sensitive apps and monitor keychain access logs.
Related vulnerabilities
Mac Malware Uses Fake CAPTCHA to Steal Keychain Credentials and Drain Crypto Wallets
A Go‑based malware delivered via a ClickFix phishing scam infected macOS systems by executing a terminal command. The payload extracts Keychain passwords and drains cryptocurrency wallets. Defenders should block the malicious domain, update EDR signatures, and audit Keychain access logs.
Read briefing
ClickFix Campaign in Ukraine Deploys Lunex Infostealer via Fake Cloudflare Pages
Over 100 Ukrainian websites were hijacked to serve a counterfeit Cloudflare verification page that prompted users to run a PowerShell command. The command installed Lunex Stealer, an infostealer that also installs the LunarAxe browser extension and NaiveMess component, giving attackers credential theft and remote control. Defenders should block malicious domains, monitor for Lunex signatures, and educate users against executing unknown scripts.
Read briefing
GoldPickaxe iOS Trojan: Face‑ID Stealer and How to Detect It
GoldPickaxe is a new iOS Trojan that harvests Face‑ID data and exfiltrates it to remote servers. The malware targets iOS 14+ devices, exploiting a flaw in the biometric framework. Defenders should enforce strict app vetting, monitor for unauthorized biometric usage, and keep devices updated.
Read briefing
Deimos Remote Access Tool: Updated TTPs and Elastic Security C2 Takedown
Elastic Security dismantled the command‑and‑control infrastructure of the Deimos remote‑access implant, exposing its advanced obfuscation and signed lure tactics. The implant delivers initial access, persistence, and full C2 capabilities, making it a potent threat. Defenders should block known C2 endpoints, deploy detection rules, and monitor for suspicious signed binaries.
Read briefing