P7 DarkSword Spyware Hunts Crypto Wallets: Check This

On October 8, 2026, the security research firm iVerify disclosed a new variant of iPhone spyware it calls P7 DarkSword, first reported in detail by 9to5Mac's coverage of the disclosure. The firm first found an infection in August and spent weeks tracing what the malware does once it lands on a phone. The headline finding for anyone holding Bitcoin, Litecoin, Dogecoin, or Bitcoin Cash in a mobile wallet: P7 DarkSword specifically looks for wallet apps, pulls data from at least one of them, and reports back to its operator on a short, remotely adjustable timer. This is an iPhone spyware crypto wallet threat in the most literal sense, built to find wallets, not just data in general.

This post walks through what the malware does, how to check whether your own phone could be exposed, and what to do next. No step here requires trusting a claim you cannot verify yourself.

First: what this iPhone spyware crypto wallet threat does

P7 DarkSword is not a new iOS vulnerability. iVerify describes it as a later-stage payload that installs itself after an earlier exploit chain, known as DarkSword, has already succeeded on an unpatched phone. Once running, it carries two wallet-specific functions: one scans the device for installed wallet apps, and a second, more developed function extracts data specifically from imToken, the only wallet named in iVerify's report so far. It also reads Keychain credentials and Apple Notes, and processes the data on the phone before sending a packaged version out, rather than copying an entire database at once.

The implant checks in with its operator roughly every 15 seconds by default, and that interval, along with its instructions, can be changed remotely. iVerify says it has observed delivery through malicious ads and watering-hole websites, not through the App Store. As of this writing, no stolen funds have been confirmed or quantified from this specific campaign, and researchers have not established whether the current build can bypass Apple's most recent patches.

Then: check whether your phone is in the iPhone spyware exposure group

The exposure here depends on two things: whether your iPhone is running an outdated iOS version, and whether you installed a wallet app directly on the device rather than keeping keys on separate hardware. Concretely:

1. Open Settings, then General, then Software Update, and confirm you are on the current iOS release. Unpatched phones running older builds are the group this malware chain targets.
2. Think back over the last few months for unusual ad clicks, pop-ups, or links you followed from an unfamiliar site. iVerify's delivery method relies on exactly that kind of click, not a text message or a call.
3. If you use imToken or any mobile wallet app with funds in it, treat that device as higher priority for the remaining steps below.

Next: patch and isolate before you open a crypto wallet again

If step one showed you are behind on updates, install the current iOS version before touching any wallet app on that phone. A patch does not undo an existing infection, but it closes the entry point the DarkSword chain depends on, which matters for everything that follows.

After updating, the safer move for any meaningful holdings is to stop keeping the private keys for them on a general-purpose phone at all. A phone that also browses the web, runs ad-supported apps, and installs software from outside a single trusted store carries more attack surface than a device built to do one thing. This is the same logic behind hardware signing devices and dedicated mining rigs: fewer attack surfaces touching the keys. Solo miners running Bitcoin, Litecoin, or Dogecoin through NexusPool's Stratum setup already keep payouts flowing straight to an address they control; the same instinct, keeping control narrow and verifiable, applies to how that address is generated and stored in the first place.

Finally: if you think a device is already compromised

If you believe an iPhone has already been infected, the standard response is to treat every credential on that device as burned: move funds controlled by any wallet on it to a new wallet generated on a clean device, change passwords stored in that device's Keychain, and only then wipe and restore the phone from a clean backup, not from the existing one. Do this before, not after, confirming anything with the malware still potentially active.

None of this requires trusting NexusPool or anyone else's claim about what happened to your device. Each hour, NexusPool signs a receipt for the mining shares it counted from every connected rig, called the Glass Ledger, checkable against a key the pool publishes rather than a balance held on trust. The same instinct applies here: check the thing yourself rather than taking a report at its word. You can see how that receipt system works on NexusPool's Glass Ledger page, and see exactly what a found block's payout would look like before it happens on the Payout Preflight tool.

This post does not claim P7 DarkSword has stolen any specific reader's funds, does not claim Apple's current patches fully close the underlying exploit chain, and is not investment or security-product advice; it describes one disclosed malware campaign and a set of checks anyone can run themselves. If you only do one thing after reading this, make it the first step above: confirm your iOS version before you open a wallet app again.

Trust nothing. Verify your own update status before you trust your own wallet app.