iVerify published an October 8, 2026 report on P7 DarkSword, a previously unseen variant of the DarkSword iPhone spyware. Its team says the investigation began with an August alert on a customer's device and continued with the customer's consent and additional forensic artifacts.
The researchers describe changes in stealth, stability and data theft. P7 removes some debug logging and reduces process injections. It uses browser local storage to avoid repeatedly exploiting the same device. These are findings about the examined spyware, not proof that every iPhone is affected.
The report says P7 extracts keychain data into JSON on the phone before sending it to the attacker's infrastructure. Earlier DarkSword versions copied the keychain database for processing elsewhere. P7 also includes wallet-related data collection and more advanced two-way command-and-control communication.
iVerify describes capabilities to collect files, photos, installed-app information and Apple Notes data, as well as commands that alter the implant's behavior. These capabilities help explain the privacy risk after compromise; they are not evidence of how widely P7 has spread or how often each capability was used.
This is a report on a spyware variant, not an announcement of a newly discovered iOS vulnerability. The report's hardcoded browser user-agent string is not reliable evidence of the infected phone's operating-system version. Readers should not infer that current fully patched iPhones are newly vulnerable from that string or from this report alone.