iPhone Spyware Polls Attacker Infrastructure Every 15 Seconds by Default, Can Scan Crypto Wallets

A newly identified iPhone spyware variant can poll attacker infrastructure every 15 seconds by default and scan for cryptocurrency wallet applications after an iPhone was infected, although no cryptocurrency theft has been confirmed. The variant, called P7 DarkSword, was identified during an investigation into an iPhone infection in August 2026. The findings were published Oct. 8. P7 includes a wallet_scan command that searches for installed wallet applications and a wallet_extract command that collects wallet-related data from imToken. Its /beacon request polls attacker infrastructure every 15 seconds by default, while a remote sleep command can change the interval.

Source: TokenPost