# Researchers uncover new DarkSword spyware variant affecting unpatched iPhones

> **Open Intelligence Dossier** · First detected: 2026-10-09 11:40 UTC · Category: Technology

## Executive Summary
Researchers uncover a new DarkSword spyware variant targeting unpatched iPhones to steal personal data and crypto wallet phrases.

## Intelligence Brief
Recent reports from outlets including Bhaskar English, Digital Trends, CyberSecurityNews, iVerify, and 9to5Mac detail the emergence of a newly uncovered spyware variant identified as DarkSword or P7 DarkSword. According to the coverage, this malicious tool functions as an iOS exploit platform utilizing Coruna malware. The specific capabilities highlighted in the reports include the theft of user passwords, general device data, and crypto wallet recovery phrases. The coverage specifies that the exploit targets unpatched iPhones, allowing hackers to compromise devices and access sensitive user information in real time through mechanisms described as sleep, beacon, steal, and repeat. Specific publications have framed the threat around distinct vectors and consequences for users.


Digital Trends emphasizes that DarkSword has returned with a significantly more malicious capability that permits real-time data theft from compromised mobile devices. CyberSecurityNews zeroes in on the technical mechanism involving the Coruna malware and the direct threat to cryptocurrency assets via stolen wallet recovery phrases. Meanwhile, platforms like 9to5Mac and Bhaskar English focus on the broader user vulnerability, advising caution and detailing what the P7 DarkSword malware actually entails for device owners, while iVerify provides investigative analysis reflecting the cyclical nature of the spyware's activity. The broader context provided by the coverage centers on the persistent vulnerability of mobile operating systems and the continuous evolution of advanced spyware platforms. The reports highlight the specific risk posed to users who have not applied the latest security updates, creating an opening for sophisticated exploit platforms like DarkSword to infiltrate devices.


While the historical background of the DarkSword platform is not fully detailed in the current headlines, the coverage underscores an ongoing arms race between malicious developers deploying tools like Coruna malware and security researchers working to identify and mitigate these platform-level threats. As the situation develops, readers and device users must monitor subsequent updates from security researchers and technology publications to understand remediation steps. Coverage does not yet specify a comprehensive manufacturer patch release date or official mitigation advisory beyond the general warning regarding unpatched devices. Observers will be tracking further technical disclosures from reporting outlets such as iVerify and 9to5Mac to determine the full scope of devices affected and whether additional software vulnerabilities are being exploited by the DarkSword platform.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Android Headlines | Still on iOS 18? A Stealthier DarkSword Variant Could Be Your Problem | [Source Link](https://news.google.com/rss/articles/CBMitAFBVV95cUxQUzdJVjlVRmFVRjE5VDdXYmFVTjc2cC15QU01RGdIMTJRS2JXby0wTFh6NVo4TFpiWWdWLU8wNGNJTFJDWXRKbDl1S0MtTTVBRTVmcG10Z1Z4ZzJldXpIMGlJRTVpVFgzOHh6dnMwWlpJWXVvRThJWW9OQ3NPX2FYbTFCMzUzcndMQlhYcUVpZS00M09xbFAtZElqZUxtbFcxbFlZanhjanFhVWFOUlh3VEk0MGQ?oc=5) |
| Bhaskar English | iPhone users beware! New spyware can steal passwords and data: What is 'P7 DarkSword' malware, and how to s... | [Source Link](https://news.google.com/rss/articles/CBMitAFBVV95cUxQM3lOYnJnSi1PZk9hZmo5U1BIeFYwLW05TnVMb0h3MWQ3Z1Q3Z0tMTzZQb3hXMlJSM2dFbVh1c3ZCSUU0bG03ZVRxTTB6WFcwazNHdEhfQjNwT1ZlMU1Oc0o3VDBJLUJueXIxY0VJVHozNlBGY1VHdnR5eUFXamEwVjZua2tZN2lCclV6NUZKWHdWdkhnRnhEN1lhMTc0eWVTZTkyYWZtd0VxMTJiaWRzOVBWWW7SAboBQVVfeXFMTUdsX2ZTNHJPQVR6Sk0xQXB3c1M5ZVp5VWFJWERhTHE0cTVDdDBtTnJROUUyUTZmZ2FhVE95RU5oZmt4STJtV2V2TVFFbGdWcTV6V1dCVzE2dHN1RV9ZVHk0UzBjYlpPOTZydzU5cGE4R29UcGZIV1FwRURIZnB4eWY1QWZNTFJtdFF0WGJhR1YzeFdzczBRVDBWQVpEcFR) |
| Digital Trends | DarkSword returns with a nastier trick that lets hackers steal your iPhone data in real time | [Source Link](https://news.google.com/rss/articles/CBMiygFBVV95cUxNei1uN0hVY2Z2Y0N5cVAxdmhOTVdWanZ2c3NGbjdqU3pmaGpVMlJuaGY0SVdvNkNfVEFCc2FCVE9UODkxMVJBV2FWYlNyVEFkUFhTMmx0WUVZUlFjVi1aOVl2ekhOa01xclpYNUFPY0FWNWlYYlBRYnpRM0ZaSWtYRjRaS3pGZ2RLdUJrWXZMM1k3SmdyZmNCMU9ELUI1MlFPMDVCSi1tWnZUMmFsTmpwa1o2NExRdVhGQ0xGcXo5VTJFRHNPMmRQWG9B?oc=5) |
| CyberSecurityNews | DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases | [Source Link](https://news.google.com/rss/articles/CBMibkFVX3lxTE5IdE1CQlhHdWlhbGt5WHBCTVI0cXo5STJNYnlRWmxXcFlzNGVNdWZBTkF3aDhudVlqQWtPSk1fVTctN185S3B0dDZfT29DMy1jSVpVNVFaUE95blpTazk1ZlZFZTBhd3dHdVB1V2dR0gFzQVVfeXFMT0tUN21zU0REN2VNZXFSLUVoRml4ejBWZDdQRXZUR1FLTTYzVk5zSXBzSVAtbHF0V2JyR085QklaTUVVRDJibGlyaHRTSFFvQy11dkt0ZnpadjFOM3I3NkZZZUpDRUxPS1QzcUVwanRQSTJFUQ?oc=5) |
| iVerify | Sleep, Beacon, Steal, Repeat - The Story of P7 DarkSword Variant | [Source Link](https://news.google.com/rss/articles/CBMib0FVX3lxTE5MMWpaWEpld0lRWDhkSlNqSnpPYlhiMUxiZE1UVWhWeHZZVkhST25iVUtBWllZWldIRldOTlVPSFBTaXp1N3A1T242eTlIM0ozUEstTEZZZ2J6Q0hFbmZkVXhDdkczNTdpNVp2TkRQaw?oc=5) |
| 9to5Mac | Researchers uncover new DarkSword spyware variant affecting unpatched iPhones | [Source Link](https://news.google.com/rss/articles/CBMirgFBVV95cUxPaENjY1hmOEVQMkpLMnpRelhTUFFOMXg0MmpVMXVRWWVCMTdBU1JSY1Ffbk0tRDBrWGVUSnNDYmJSQy1VTXcwaTBXRi1hVUl3UmV6a1RkelFibnJNZXgzMUJxOHhESUw2ZjAzMmNaNFo0Rm83cEE2dXIwSnNhaEU0UUFrRUtiaTJyeXVRZGJpeHVzV3lrbUlESWViSXYwdFFSVFU3cm10Yy04eUJ2ZWc?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-10-09/researchers-uncover-new-darksword-spyware-variant-affecting-unpatched-iphones*