P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
-
Cybersecurity researchers at iVerify have disclosed a previously unseen variant of the DarkSword iOS exploit kit, tracked as P7 DarkSword. The findings were published in a new report on Thursday.
Compared to the DarkSword variants typically observed in the wild, this iteration makes notable changes to both its stealth and its data-stealing capabilities. The P7 DarkSword variant:
- Reduces its on-device footprint, making it harder to detect
- Adds on-device theft of keychain data and crypto-wallet credentials
- Introduces two-way C2 (command-and-control) communication with the attacker's infrastructure
The addition of two-way C2 is a significant shift, as it allows the operator to issue remote commands to compromised devices rather than simply exfiltrating data one way. The inclusion of keychain and crypto-wallet targeting also points to a focus on high-value credentials and digital assets.
At this time, no specific CVE identifiers, affected iOS versions, or indicators of compromise have been provided in the available reporting.
Source: The Hacker News
Does your organization have detection or hardening measures in place for iOS keychain and crypto-wallet data on managed devices?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login