New iPhone spyware can steal passwords and photos

Your iPhone probably holds more personal information than your wallet. Think about the passwords you've saved, the photos you never intended to share and the private notes you keep handy. Now, security researchers have uncovered a more aggressive version of spyware designed to get its hands on that information.

The threat is called P7 DarkSword, and researchers at mobile security company iVerify discovered it while investigating an infected iPhone. According to their Oct. 8, 2026, report, can collect sensitive information and communicate with attackers who can issue additional commands remotely.

That sounds alarming, and it should get your attention. However, the research does not establish that every iPhone is vulnerable. Here's what researchers discovered and how you can better protect your device.

YOUR PHONE SAYS IT'S UPDATED. CHECK OTHER SETTINGS, TOO

Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money

In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You'll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.

Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.

P7 DarkSword is a newly identified variant of DarkSword, an existing iPhone spyware family. Researchers at iVerify discovered it while investigating a suspicious infection in August 2026. Their security system had flagged unusual activity on a customer's device. After examining the phone with the customer's permission, the team discovered that the spyware behaved differently from versions they had previously encountered.

The researchers also searched for using the Validin threat intelligence platform. Eventually, they identified another version of the spyware hosted on suspicious infrastructure. Their analysis revealed that the attackers had modified the code to make it more capable and harder to investigate. The name P7 comes from a prefix the attackers used in their programming code. While that detail won't mean much to most iPhone owners, the changes behind it are concerning. The spyware now performs more data collection directly on the infected phone and gives attackers additional control over what happens next. Apple told CyberGuy that DarkSword originated from sophisticated mercenary spyware developed at considerable expense. After the spyware leaked, the technology became available to common criminals.

Once attackers successfully compromise a vulnerable device, P7 DarkSword can reach information that most people would consider deeply private. Researchers identified several capabilities in the spyware's code.

For someone who keeps sensitive documents or financial information on an iPhone, the potential exposure is serious. However, these findings describe the spyware's capabilities. They do not establish that attackers successfully stole every type of information from the device involved in the investigation.

One particularly troubling feature is how frequently the spyware can contact its operators. According to iVerify, P7 DarkSword uses a command-and-control system that can check for instructions every 15 seconds. Attackers can change that interval remotely. This allows the spyware to receive new instructions after the initial infection. For example, an attacker could direct it to collect additional files or examine information stored on the device. The malware also supports commands