DarkSword on iPhone: the six-bug chain, P7, and which iOS is safe

On 25 October 2026, BIDV, VietinBank and Agribank all told their iPhone customers to update iOS because of malware called DarkSword. What is DarkSword, which iPhones can it actually reach, and what should you do about it? Short answer: it is a chain of six iOS vulnerabilities, all patched months ago, that takes over an unpatched iPhone running iOS 18.4 to 18.7 when it opens a booby-trapped web page. The new part is a variant called P7 that steals Keychain passwords and crypto wallets.

I read the primary reports from Google Threat Intelligence Group, iVerify and Apple. This post puts the details in one place: the timeline, how the chain works, what each payload takes, how to check your phone, and what people who build websites can learn from it.

DarkSword in one paragraph

DarkSword is a full-chain exploit kit for iOS: it goes from "Safari loads a page" to "attacker has kernel privileges" without the user tapping anything. Google's threat intelligence group (GTIG) named it after strings found in recovered payloads and published its analysis in March 2026. It uses six vulnerabilities, three of them zero-days when first used, and supports iOS 18.4 through 18.7. Unusually, the entire chain and every payload GTIG recovered is written in JavaScript, which matters for both how it runs and how easily it spread.

Timeline: from zero-days in late 2025 to Vietnamese bank warnings

The bank warnings are about a threat that has been patched for most of a year. The risk is the long tail of phones that never installed those updates, and Apple has said about a quarter of active devices still run iOS 18 or older, according to Kaspersky's write-up.

The chain: six bugs from a web page to the kernel

Each stage gives the attacker a little more of the phone. This table follows GTIG's breakdown:

A browser bug alone gets the attacker into Safari's web content process, which is tightly sandboxed. The two sandbox escapes and the kernel bug are what turn that into access to messages, the Keychain and other apps' data. That is why patching any one link would have broken this particular chain, and why a fully updated phone is not reachable by it.

Why being written in JavaScript matters

GTIG found no native binaries in the samples. Once the attacker has memory read/write, the later stages load a copy of the JavaScript engine inside mediaplaybackd and keep going in JavaScript, calling native functions through helper objects. Two consequences follow.

First, the chain did not need to defeat Apple's protections against running unsigned native code (PPL and SPTM), because it never ran any. It reused code Apple had already signed.

Second, it is easy to copy and adapt. A JavaScript exploit is readable text. Kaspersky reports that attackers left the full source on the infected websites, and a copy appeared on GitHub within days of the disclosure. An iVerify researcher told TechCrunch it "can be repurposed far too easily". This is how a tool sold to surveillance customers ends up in campaigns against ordinary people looking for crypto wallets.

There is one upside. According to Kaspersky, the malware is fileless and does not survive a reboot. A restart ends the infection, though it does not undo whatever was already uploaded.

How victims reach the exploit: watering holes and ads

Nobody is sent a malicious app. The kit is served from web pages: a decoy site, a page owned by the attacker, or a legitimate site that has been compromised with one extra <script> tag (a "watering hole"). iVerify's P7 victim was reportedly reached through malicious ads.

The landing pages filter visitors before serving anything, according to GTIG:

• Fingerprinting checks that the browser looks like real iOS Safari (for example, that Apple Pay and WebGL2 exist and Android or Chrome-specific APIs don't).
• A session flag in sessionStorage (P7 uses localStorage) stops the same device from being attacked twice.
• Non-targets are redirected to an ordinary page, so most visitors see nothing unusual.
• A hidden, zero-size iframe loads the loader, which picks the exploit matching the iOS version.

For a user this means there is no visible moment to be suspicious of. "Don't click strange links" is still good advice, but here the trigger can be a news site you visit every day or an ad slot on it.

What the payloads take

GTIG found three payloads, each used by a different customer of the kit, all in JavaScript:

All three delete crash reports from the processes the chain touched, which removes an obvious trace.

P7: the variant behind this week's warnings

P7 is not a new iOS vulnerability. It is a modified implant delivered after the same DarkSword chain succeeds, named after the p7_ prefix its authors added to the code. iVerify lists what changed:

• Quieter: no debug logging, fewer process injections, and storage-based checks to avoid exploiting the same phone repeatedly.
• Keychain extraction on the device: it builds a JSON file of Keychain items before upload, instead of copying the whole database out.
• Crypto wallets: commands to find wallets and a dedicated handler for imToken.
• Two-way control: the implant runs inside SpringBoard (the home screen process) and polls its server every 15 seconds for commands such as downloading files, uploading photos, listing apps, copying Apple Notes databases and running arbitrary JavaScript.

iVerify contrasts P7 with the many AI-assisted variants it sees: the P7 authors understood the code they were modifying. It also notes that the older indicators no longer catch it. This is why VietinBank's notice says the usual signs of infection are no longer reliable.

Check your iPhone: which versions are safe

Go to Settings › General › About and look at the iOS version. Based on Apple's advisory and the list of security releases:

Anything on iOS 18.4 to 18.7.6 is in the exposed range. If you are on iOS 18 with an iPhone 11 or newer, Apple's advice is to move to the current major version, which has the strongest protections.

What to do, in order

1. Update in Settings › General › Software Update, and turn on automatic updates.
2. If you can't update right now, turn on Lockdown Mode (Settings › Privacy & Security). Apple states that devices with it enabled are protected from these attacks even on old software. It blocks some complex web technologies, so a few sites will behave differently.
3. Keep Safari's Safe Browsing on. Apple says it blocks the domains identified in these attacks.
4. If you think the phone was compromised, the banks' advice matches the reports: back up what matters, restore the phone, update, then change your banking and important passwords from a device you trust. Move funds out of any hot wallet whose keys were on the phone, because P7 targets exactly that.

Two limits are worth knowing. Restarting removes a fileless implant but not the consequences of what it already sent. And updating protects you from this chain, not from the next one. Nothing here replaces bank-side protections such as OTP and transaction limits.

What builders of websites can take from it

DarkSword needs a web page to start from, and many of those pages were legitimate sites with one injected script, or ad slots. If you run a site, the useful questions are about what code you let run on it:

• Know every third-party script. An ad network or analytics tag runs with the same power as your own code. A Content Security Policy that lists the allowed script origins makes an injected <script> from an unknown domain fail.
• Pin static third-party files with Subresource Integrity, so a changed file on a CDN is refused.
• Treat "my site was used to serve malware" as a real incident class, not only "my data was stolen". Monitoring for unexpected <script> or <iframe> tags in production HTML catches the injection itself.

These measures shrink the chance that your site becomes the delivery step. They do nothing for a visitor whose phone is unpatched and who reaches the exploit some other way, which is why the update is still the fix that matters.

Summary

• DarkSword is a six-bug iOS exploit chain for iOS 18.4–18.7, written in JavaScript, triggered by visiting a page.
• Every bug is fixed: iOS 26.3+ or 27, 18.7.7+ on older iOS 18 devices, 15.8.7 or 16.7.15 on the oldest.
• P7 is a stealthier implant for the same chain that takes Keychain data and crypto wallets; it is what the Vietnamese banks are warning about.
• Can't update: Lockdown Mode. Suspect an infection: back up, restore, update, change passwords elsewhere.
• Site owners: control third-party scripts with CSP and SRI so your pages don't become the watering hole.

If you've handled the fallout of an exploit kit on a fleet of phones or a compromised site, I'd love to compare notes. My email is on the home page.