iVerify found P7 DarkSword can scan for crypto wallet apps and extract imToken data from already compromised iPhones. It can also collect passwords, Apple Notes, photos and app files.

The default 15-second cycle polls for attacker commands, rather than guaranteeing wallet extraction at that interval. Researchers confirmed neither completed crypto theft nor a bypass of the latest iOS patches.