Security researchers have reported a new variant of the DarkSword iOS exploit kit, described as P7 DarkSword, with expanded data theft and remote control capabilities. According to iVerify, the variant reduces its on-device footprint while adding keychain theft, crypto wallet data theft and two-way command-and-control communication with attacker infrastructure.

While the published details are limited, the reported feature set makes this development relevant for businesses that rely on iPhones for work, identity verification, financial access and executive communications.

What happened

In a newly published report, iVerify disclosed a previously unseen variant of the DarkSword iOS exploit kit. The company said the new P7 version differs from variants it has usually observed in three main ways:

• It reduces its device footprint, which may make it harder to detect.
• It adds on-device theft of keychain data, which can include saved credentials, tokens and authentication material.
• It adds theft targeting crypto wallet data.
• It supports two-way communication with attacker-controlled infrastructure, enabling remote commands as well as data exfiltration.

These points come from the researcher report. As with any early disclosure, businesses should distinguish between what has been reported by the security company and what has been independently confirmed by broader industry analysis.

Why it matters for European businesses

For many SMEs and larger organisations, iPhones are not only communication devices but also part of the company’s security and operational stack. They may store business email access, password manager sessions, multi-factor authentication codes, VPN credentials, cloud app tokens and messaging data.

If an iOS compromise allows attackers to extract keychain material or maintain remote communication with infected devices, the business impact can extend beyond the phone itself. A mobile compromise can become a route into:

• Business email accounts
• Cloud software and SaaS platforms
• Admin dashboards and website back ends
• Banking or payment-related access
• Internal messaging and sensitive executive conversations

The mention of crypto wallet theft is also relevant to companies that hold digital assets, accept crypto payments, work in Web3, or have founders and finance teams using mobile wallets for business-related activity. Even businesses without direct crypto exposure should view the report as a broader sign that attackers are targeting high-value data stored on mobile devices.

The added two-way command capability is especially important from a risk perspective. It suggests a potentially more interactive post-compromise model in which attackers may issue commands, adapt activity and maintain persistence rather than simply stealing a fixed dataset.

Who may be affected

• SMEs using iPhones for work, especially where mobile devices access email, CRM, cloud storage or admin tools.
• Founders and executives, who often hold high-value credentials and sensitive communications on mobile devices.
• IT and security teams responsible for mobile device management, identity security and incident response.
• E-commerce businesses where staff access storefronts, payment systems, ad accounts or analytics platforms from mobile devices.
• Businesses handling digital assets or using crypto wallets in treasury, payments or product operations.

What companies should consider

Even without full technical detail, the report is a useful reminder to review mobile security controls as part of the wider business security programme.

• Review mobile device management policies for company-managed and bring-your-own devices that access business systems.
• Limit credential exposure on phones by reducing unnecessary local storage of sensitive access tokens and reviewing how password managers and authentication apps are used.
• Harden executive devices, as leadership phones often provide a path to email, payments and strategic information.
• Monitor for unusual account activity across email, SaaS platforms, admin dashboards and financial services that could indicate stolen mobile credentials.
• Segment access so a compromise of one device does not automatically provide broad access to critical systems.
• Review incident response procedures for mobile compromise scenarios, including device isolation, credential rotation and token revocation.
• Assess crypto wallet handling if the business stores or transacts digital assets, particularly where mobile wallets are used operationally.
• Keep iPhones and business apps updated and ensure staff know how to report suspicious device behaviour quickly.

For European businesses, the practical lesson is clear: mobile security should be treated as part of core identity, cloud and operational security, not as a separate endpoint issue. A successful mobile compromise can affect access control, data protection and business continuity across multiple systems.