Your iPhone probably holds more personal information than your wallet. Think about the passwords you’ve saved, the photos you never intended to share and the private notes you keep handy. Now, security researchers have uncovered a more aggressive version of spyware designed to get its hands on that information.
The threat is called P7 DarkSword, and researchers at mobile security company iVerify discovered it while investigating an infected iPhone. According to their Oct. 8, 2026, report, the spyware can collect sensitive information and communicate with attackers who can issue additional commands remotely.
That sounds alarming, and it should get your attention. However, the research does not establish that every iPhone is vulnerable. Here’s what researchers discovered and how you can better protect your device.
YOUR PHONE SAYS IT’S UPDATED. CHECK OTHER SETTINGS, TOO
Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money
In this free live online class, Kurt “CyberGuy” Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.
P7 DarkSword is a newly identified variant of DarkSword, an existing iPhone spyware family. Researchers at iVerify discovered it while investigating a suspicious infection in August 2026. Their security system had flagged unusual activity on a customer’s device. After examining the phone with the customer’s permission, the team discovered that the spyware behaved differently from versions they had previously encountered.
The researchers also searched for related malicious code using the Validin threat intelligence platform. Eventually, they identified another version of the spyware hosted on suspicious infrastructure. Their analysis revealed that the attackers had modified the code to make it more capable and harder to investigate. The name P7 comes from a prefix the attackers used in their programming code. While that detail won’t mean much to most iPhone owners, the changes behind it are concerning. The spyware now performs more data collection directly on the infected phone and gives attackers additional control over what happens next. Apple told CyberGuy that DarkSword originated from sophisticated mercenary spyware developed at considerable expense. After the spyware leaked, the technology became available to common criminals.
Once attackers successfully compromise a vulnerable device, P7 DarkSword can reach information that most people would consider deeply private. Researchers identified several capabilities in the spyware’s code.
For someone who keeps sensitive documents or financial information on an iPhone, the potential exposure is serious. However, these findings describe the spyware’s capabilities. They do not establish that attackers successfully stole every type of information from the device involved in the investigation.
One particularly troubling feature is how frequently the spyware can contact its operators. According to iVerify, P7 DarkSword uses a command-and-control system that can check for instructions every 15 seconds. Attackers can change that interval remotely. This allows the spyware to receive new instructions after the initial infection. For example, an attacker could direct it to collect additional files or examine information stored on the device. The malware also supports commands that scan the phone’s file system and execute JavaScript inside its running environment.
Researchers found that the spyware injects its communication component into SpringBoard, a core iPhone system process responsible for the Home Screen and other interface functions. The attackers also removed some diagnostic logging and reduced certain activities that could reveal the infection during an investigation. These changes make the spyware harder for security researchers to examine. However, iVerify did not establish that the malware is completely undetectable.
APPLE AIRDROP, ANDROID QUICK SHARE FLAWS PUT PHONES AT RISK
DarkSword is associated with an iOS exploit chain that attackers can use to compromise vulnerable devices through malicious web content. Security researchers have linked the P7 variant to distribution through malicious advertisements and compromised websites, sometimes called watering-hole attacks.
That means someone using an outdated, vulnerable iPhone could encounter malicious content while browsing the web, potentially without realizing anything unusual happened. However, these attacks depend on exploitable security weaknesses. Installing Apple’s security updates protects against the known vulnerabilities used by earlier DarkSword attacks. The original iVerify investigation focuses primarily on how P7 operates after infection. It does not fully reconstruct how the customer encountered the malicious content. That’s why the exact circumstances of that particular infection remain unclear.
Earlier DarkSword attacks targeted iPhones running iOS 18.4 through iOS 18.7. Apple told CyberGuy that it patched the underlying vulnerabilities in 2025, before DarkSword first leaked. The company also released a security update in March 2026 for older devices that could not install newer versions of iOS. According to Apple, iPhones running the latest available updates for iOS 15 through iOS 27 remain protected against the known DarkSword exploits.
Researchers also identified exploit components associated with iOS 18.7 in the newer P7 investigation. However, they have not confirmed that the spyware can compromise fully updated iPhones. As of October 2026, iOS 27 is Apple’s current major iPhone software generation. However, the latest available update depends on your iPhone model. Devices that have not received available security updates may remain exposed to known vulnerabilities.
The research is a reminder that even sophisticated phone security can face serious threats. Fortunately, there are steps you can take to reduce your exposure. Start with these protections, especially if you’ve been putting off a software update.
Apple regularly releases updates that fix vulnerabilities attackers can exploit. Checking for updates is especially important if you haven’t updated your iPhone recently.
To check your current version and install updates:
Next, go to Settings > General > Software Update > Automatic Updates and enable Automatically Install. This helps your phone receive future security fixes without relying on you to remember.
On iOS 27, Apple also offers Background Security Improvements. These provide additional protections between major software updates.
This setting adds another layer of protection against newly discovered security problems.
Avoid opening unexpected links in text messages or emails, especially when they pressure you to act quickly. Malicious web content has played a role in previously documented iPhone attacks, so this is a sensible precaution. Consider using strong antivirus software that offers malicious website blocking, phishing protection and scam-link warnings. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com. These features can help you avoid dangerous content before you open it. However, iPhone security apps cannot perform the same deep malware scans available on computers. They also cannot guarantee detection or removal of sophisticated spyware like P7 DarkSword. That’s why keeping iOS updated remains essential.
HOW TO FIND COMPROMISED PASSWORDS ON IPHONE AND ANDROID
If you believe someone may specifically target you with sophisticated spyware, Apple’s Lockdown Mode offers stronger security protections. It restricts certain website technologies, messaging features and device connections to reduce opportunities for attackers. Apple designed this feature for people facing unusually advanced threats. Most iPhone owners won’t need it because some everyday features become limited. According to Apple, security researchers confirmed that the known DarkSword exploits do not work on devices with Lockdown Mode enabled.
To turn it on:
For more on targeted attacks, read our article about Apple’s spyware warnings reaching iPhone users in 110 countries.
Because P7 DarkSword can target keychain and cryptocurrency wallet information, pay attention to unusual activity in your sensitive accounts. Apple recommends protecting your iPhone with a passcode, using a strong password and two-factor authentication (2FA) for your Apple Account and installing apps from the App Store. Use a reputable password manager to generate and securely store strong, unique passwords for every account. Review alerts from financial services. Keep in mind that a password manager cannot protect credentials if sophisticated spyware has already compromised your device. If you have credible evidence that your iPhone was compromised, change important passwords using another trusted device. Also, contact your financial institutions if you notice unauthorized transactions. Cryptocurrency users should seek trusted wallet-security assistance before moving funds. These steps can limit damage after an account compromise, although they cannot remove sophisticated spyware from an infected phone.
Advanced spyware may operate without obvious symptoms. Your iPhone could appear to work normally, so a healthy battery or the absence of strange pop-ups cannot prove that your device is clean. If you receive what appears to be an Apple threat notification, verify it by signing in directly at account.apple.com, rather than clicking links in the message. Apple provides additional information about recognizing and responding to these alerts on its threat notification support page. Then seek assistance from a qualified mobile security specialist. A routine security app scan may not detect an advanced infection.
If you have strong reason to suspect spyware, avoid using that phone for sensitive activities until you’ve received guidance. From a separate trusted device, secure important accounts and review recent sign-ins. You should also preserve any genuine Apple threat notifications or suspicious messages. For a potentially targeted attack, contact a specialist before erasing your iPhone. Resetting the device can destroy evidence investigators may need, and it may complicate efforts to determine what happened.
What concerns me most about this discovery is how much information attackers could potentially collect from a single phone. We trust our iPhones with some of our most private information, often without thinking twice about where we store it. P7 DarkSword shows how dangerous that access could become if attackers successfully exploit a security weakness. It’s also troubling to see expensive mercenary spyware leak into the hands of common criminals. Apple says the vulnerabilities behind these known attacks were patched before the spyware leaked, which is reassuring for people who keep their devices updated. I would check your iPhone’s software version today, especially if you haven’t updated it recently. And if you use your phone for financial transactions or store sensitive personal information, take a few minutes to review your account security.
Do you trust your iPhone to keep your personal information safe, or does discovering spyware like DarkSword make you question how secure your phone really is? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Newsletter
Copyright 2026 CyberGuy.com. All rights reserved.
