New iPhone spyware threat

Security researchers discovered P7 DarkSword spyware that can steal passwords and photos from infected iPhones.

“P7 DarkSword”

How spyware works

The spyware collects sensitive information and communicates with attackers who can issue additional commands remotely.

What spyware steals

P7 DarkSword can access saved credentials, cryptocurrency wallet data, personal photos, Apple Notes, and application files.

Spyware infection method

Attackers compromise vulnerable iPhones through malicious web content, often via outdated software or watering-hole attacks.

Vulnerability timeline

Earlier DarkSword attacks targeted iOS 18.4 through iOS 18.7, but P7 DarkSword exploits newer iOS versions as of October 2026.

How to protect your phone

Install the latest iOS updates, enable background security improvements, and use strong antivirus software to reduce spyware risks.

Apple's response

Apple patched vulnerabilities before DarkSword leaked and released security updates for older devices running iOS 15 through iOS 27.

Critical security steps

Enable Lockdown Mode for advanced protection, use strong passwords, and monitor accounts for unusual activity after potential compromise.

What to do if infected

Avoid sensitive activities on the phone, secure accounts from another device, and contact a specialist before erasing the device.

Kurt's key takeaways

P7 DarkSword shows how dangerous unpatched iPhones can be for sensitive information and highlights the need for regular security updates.

Spyware communication

P7 DarkSword checks for instructions every 15 seconds, allowing attackers to issue new commands remotely.

DarkSword origin

DarkSword originated from sophisticated mercenary spyware developed at considerable expense and became available to common criminals after leaking.

iOS vulnerability timeline

P7 DarkSword targets iPhones running iOS 15 through iOS 27, but full protection requires up-to-date security patches.

Apple security updates

Apple released security updates in March 2026 for older devices that could not install newer iOS versions.

Spyware detection

The spyware injects into SpringBoard, a core iPhone system process, and removes diagnostic logging to evade detection.

Protection steps

Enable automatic software updates, use strong passwords, and monitor accounts for unusual activity to reduce spyware risks.