P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

A new variant of the DarkSword iOS exploit kit, dubbed P7 DarkSword, has emerged, exhibiting enhanced stealth and data theft capabilities. The kit leverages multiple vulnerabilities, including CVE-2025-24201 and CVE-2025-31200, and is associated with a Chinese-speaking threat actor involved in cryptocurrency wallet theft. The exploit kit is distributed through a service-as-a-service model, with evidence of its use against multiple C2 servers.