P7 DarkSword Adds On-Device Keychain JSON Extraction and 15-Second Bidirectional C2 Polling

The P7 iteration of the DarkSword exploit kit, first documented by Google Threat Intelligence Group and iVerify in March 2026, chains browser sandbox escapes through kernel privileges into SpringBoard injection. It now performs on-device keychain parsing into JSON rather than raw database copies, adds crypto wallet scraping, and implements two-way C2 via localStorage to avoid re-exploitation. Command responses support execute_command, ls, download, and memdump operations. Evidence from iVerify telemetry shows deployment in Saudi Arabia, Turkey, Malaysia, and Ukraine since November 2025, including PARS Defense lures and Star Blizzard campaigns. Censys mapped a parallel Chinese-speaking actor serving Apple ID decoys alongside the kit. Debug logging removal and heartbeat mechanisms reduce observable artifacts compared with prior variants. Commercial exploit kits like DarkSword follow a predictable leak-to-repurpose pattern after public disclosure, as seen with earlier zero-day markets. Bundling attempts with Coruna source, some LLM-generated, indicate lower-skill actors accelerating modification without binary patching. This second-hand proliferation decouples technical capability from original vendor intent. Next indicators will appear in procurement records and new CVE clusters targeting iOS 26.x. Stable P7 forks are likely to surface in additional regions within 60 days as GitHub variants circulate.