Security researchers at iVerify have identified a new iPhone spyware variant called P7 DarkSood that can collect sensitive personal information and communicate with remote attackers. The discovery, detailed in an October 8, 2026 report, reveals a more aggressive version of the existing DarkSword spyware family capable of accessing passwords, photos, and private notes on infected devices.
iVerify first detected the threat in August 2026 while investigating unusual activity on a customer's iPhone. Upon examining the device with the user's permission, the team found code that behaved differently from previously known DarkSword versions. The researchers subsequently used the Validin threat intelligence platform to locate another version of the spyware hosted on suspicious infrastructure. Analysis showed that attackers had modified the code to enhance its data collection capabilities and make it harder for security experts to investigate. The name P7 refers to a prefix used in the attackers' programming code.
A key feature of P7 DarkSword is its command-and-control system, which can check for new instructions from operators every 15 seconds. This high-frequency communication allows attackers to issue additional commands remotely, such as scanning the phone's file system or executing JavaScript. The malware injects its communication component into SpringBoard, a core iPhone system process that manages the Home Screen and other interface functions. To evade detection, the attackers removed certain diagnostic logging and reduced activities that might reveal the infection, although iVerify noted that the malware is not completely undetectable.
Apple stated that DarkSword originated from sophisticated mercenary spyware developed at considerable expense before leaking to common criminals. The P7 variant is linked to distribution through malicious advertisements and compromised websites, a technique known as watering-hole attacks. Earlier DarkSword attacks targeted iPhones running iOS 18.4 through iOS 18.7. Apple confirmed it patched the underlying vulnerabilities in 2025, prior to the spyware leak, and released a security update in March 2026 for older devices that cannot install newer iOS versions.
As of October 2026, Apple's current major software generation is iOS 27. The company maintains that iPhones running the latest available updates for iOS 15 through iOS 27 remain protected against known DarkSword exploits. While researchers identified exploit components associated with iOS 18.7 in the P7 investigation, they have not confirmed that the spyware can compromise fully updated iPhones. The exact circumstances of how the initial customer encountered the malicious content remain unclear.
To reduce exposure, Apple recommends keeping software up to date and enabling automatic updates. For users facing unusually advanced threats, Apple's Lockdown Mode offers stronger protections by restricting certain website technologies and device connections. Security researchers have confirmed that known DarkSword exploits do not work on devices with Lockdown Mode enabled. Users should also protect their Apple Accounts with strong passwords and two-factor authentication, and review alerts from financial services for unusual activity.