DAILY BRIEFING
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
Today's briefing covers an updated DarkSword iOS exploit kit stealing crypto wallets and the security challenges posed by unmonitored third-party AI agents.
5 stories2 min read
A newly detailed iOS exploit kit variant highlights the persistent threat to mobile environments, while broader shifts in enterprise software show security teams struggling to maintain visibility over automated capabilities. The P7 DarkSword kit demonstrates how attackers continue to refine exploitation frameworks targeting mobile platforms to capture high-value sensitive data, including keychain contents and cryptocurrency wallet credentials.
At the same time, organizations face growing exposure from unmonitored AI agents embedded directly within vendor software. Because these capabilities frequently bypass central identity infrastructure and traditional procurement reviews, security teams must adjust monitoring practices to cover both mobile device compromises and shadow automated tools operating across existing enterprise applications.
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
iVerify reported details on P7 DarkSword, a variant of the DarkSword iOS exploit kit. P7 reduces its on-device footprint, adds theft of keychain and crypto-wallet data, and implements two-way C2 communication. The kit targets iOS 18.4 to 18.
- Why it matters
- Users running impacted iOS versions face stealthy exploitation capable of stealing sensitive keychain credentials and cryptocurrency assets directly from targeted mobile devices.
- What to do
- Update iOS devices to the latest firmware version to patch browser and kernel privilege escalation flaws.
The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI.
- Why it matters
- Enterprise security teams face unmonitored data exposure because third-party AI agents operate inside trusted software without passing through identity gateways or security review points.
Cyber exec arrested in case allegedly tied to ShinyHunters hackers
Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multiple reports have linked to the FBI's ongoing crackdown on the ShinyHunters hacking group.
ARTEX AI, Claude agents used in cyberattacks on South Korean banks
The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents.
- What to do
- Review internal AI agent usage logs and monitor threat intelligence advisories for financial sector targets.
Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management
Traditional attack surface management helps organizations discover exposed assets, but visibility alone is not enough to address threats.
Key takeaways
- P7 DarkSword targets iOS versions 18.4 to 18.7 to extract keychain data and crypto wallet credentials via two-way C2 channels.
- The exploit chain escapes browser sandboxes and escalates to kernel privileges to inject payloads into SpringBoard.
- Enterprise AI security must expand beyond first-party gateways to monitor embedded third-party agents that bypass central SSO authentication.