Security firm iVerify disclosed a strain of iPhone spyware that hunts for cryptocurrency wallets on infected devices and copies their data, according to a report published October 8, 2026. The malware, named P7 DarkSword, includes dedicated functions for finding wallet apps and extracting their contents, with specific targeting of imToken, a multi-blockchain mobile wallet.
The report describes two components built for crypto theft. A function called wallet_scan searches a device for installed wallet applications. A second function, wallet_extract, collects data from imToken once it is found. Alongside the wallet code, P7 reaches into Apple Keychain for stored passwords and authentication credentials, reads the Apple Notes database, and grabs photos and selected app files. iVerify says the spyware packages extracted Keychain information into JSON files before sending it out.
The 15-second collection loop
P7 contacts attacker-controlled servers every 15 seconds by default to request instructions, iVerify found. That design lets operators trigger data collection remotely and change the polling interval on the fly, without having to reinfect the phone. For a wallet app, the practical risk is clear: anything readable on the device, including passwords and notes where people often stash recovery phrases, can be queued for exfiltration on a short, repeating cycle.
imToken is the only wallet named in the report. That does not mean other wallets are safe on a compromised device, but it does mean the wallet_extract logic was written against imToken's specific data layout. The broader lesson is about where secrets live. Credentials in Keychain and seed phrases typed into Apple Notes are exactly the kind of artifacts this tool is built to sweep up.
This runs after a phone is already broken
One detail matters for context. iVerify frames P7 as an evolution of spyware deployed after a successful compromise, not as a new exploit that breaks into an up-to-date iPhone on its own. The report does not establish that P7 can bypass Apple's latest security updates.
Earlier DarkSword variants did use device exploits. According to iVerify, those earlier versions chained six vulnerabilities affecting iOS 18.4 through 18.7. Apple shipped protections during 2025, and iOS 18.7.7 went out on March 24, 2026. iVerify detected the infection behind this latest analysis in August and spent the following weeks studying it. The firm did not disclose evidence of a completed crypto theft or put a dollar figure on any losses.
So the threat model is specific. If your iPhone is current and uncompromised, this report is not describing a way for an attacker to reach into it remotely. If a device has already been breached, P7 shows how quickly and quietly wallet data can be siphoned off afterward.
Phone-based custody and key hygiene
The episode is a reminder that a mobile wallet concentrates two things an attacker wants in one place: the keys that move funds and the credentials that protect them. Anyone who runs a wallet they control themselves carries the full weight of that responsibility, because there is no issuer to freeze a transaction or reverse a drain once keys leave the device.
A few habits reduce the blast radius if a phone is ever compromised. Keep iOS on the latest version, since the earlier DarkSword exploits targeted software that Apple has since patched. Avoid storing seed phrases in Apple Notes, screenshots, or any file that syncs to the cloud, because those are first-tier targets for tools like this. For larger balances, a hardware wallet keeps signing keys off the phone entirely, so a compromised handset cannot by itself authorize a transfer. The recent hidden hardware implant tied to $93.4M in thefts is a reminder that even cold-storage devices need supply-chain scrutiny, but the principle holds: keys that never touch an internet-connected phone are out of reach of spyware that lives on it.
The same logic extends to how people spend crypto day to day. Crypto cards that draw from a custodial balance keep spending separate from the wallet holding long-term keys, which limits how much a single compromised app or device can expose. That is a trade-off, not a verdict. Custodial convenience versus self-custody control is a personal call, and this report does not change the math so much as it sharpens the case for keeping recovery material off the device you carry everywhere.
Overview
iVerify disclosed P7 DarkSword, iPhone spyware with built-in functions to scan for wallet apps and extract imToken data, on October 8, 2026. It also pulls Keychain passwords, Apple Notes, photos, and app files, and it checks in with command servers every 15 seconds. The tool runs on devices that are already compromised rather than breaking into current iPhones on its own, and iVerify reported no confirmed thefts. For users, the takeaways are concrete: patch iOS, keep seed phrases out of notes and cloud-synced files, and move meaningful balances to keys that never sit on the phone.
