iOS exploit kit that chains browser renderer bugs to infect unpatched iPhones with data-stealing spyware. Its leaked code has spawned reworked variants.
iVerify has disclosed P7 DarkSword, iPhone spyware that scans for crypto wallets and polls its operators for new orders every 15 seconds. It gets at wallet data through the phone's own stores, so protecting the device is now part of protecting the coins.
Reality
iVerify disclosed P7 DarkSword, a reworked variant of a leaked iOS exploit kit for iPhones on iOS 18.4 to 18.7 that steals keychain and crypto-wallet data. The commercial chain leaked onto a second-hand market, where financially motivated operators have been buying it since late 2025.
Reality
iVerify found P7 DarkSword, a stealthier spyware variant that steals Keychain and crypto-wallet data from iPhones hit by the DarkSword exploit chain. Apple's iOS 18.7.7 still blocks that chain for phones kept off iOS 26, so fleets need to find the devices that skipped it.
Reality
Microsoft says Star Blizzard has sent fake event invitations to more than 100 organizations since January, many from hacked WordPress and cPanel sites. The group, long known for stealing email passwords, now uses the messages to install a Windows backdoor.
Perspective Coverage
8 publishersReality
Microsoft says Russia's FSB-linked Star Blizzard sent fake event invitations to more than 100 organizations since January 2026. The lures pose as Chatham House and Atlantic Council events and carry a new Python backdoor, CosmicPulse, aimed at people working on Ukraine.
Reality
Ukraine's SSSCIP says Russian hackers are going after military and government phones, using hacked news and government sites to push the DarkSword iPhone kit. Because the kit needs little or no action from the victim, the defense falls on the phone's own software and how current it is.
Reality
Scammers wrapped the leaked DarkSword exploit chain in a fake iPhone Duo preorder page that attacks the moment it opens, before any form, tap, or download. Apple has already patched the flaws it uses, so a current iOS build is what protects a phone here.
Reality
SlowMist says its evidence for the iPhone Safari attack on crypto wallet keys covers iOS 18.4 to 18.6.2 and that it has confirmed no theft victim. The firm calls this week's iOS 13 to 26.5 warnings preliminary and still tells iPhone users to install security updates.
Reality
Blockchain security firm SlowMist says an active exploit chain walks from a Safari page to kernel access and the iOS Keychain on everything from iOS 13 to 26.5, while Apple's patches, by the same account, reach 26.3.
Reality
Socket says trojanized OphimCMS and KKPhim themes chain two WebKit bugs to an IOKit kernel escape on visitors' iPhones, turning a Composer dependency problem into wallet seed theft from people who only loaded a page.
Reality
Socket found thirteen trojanized Composer themes across five vendor namespaces, and the front-end assets those packages ship carry an iPhone exploit chain out to the mobile visitors of every site that installs one.
Reality