Researchers found a new iPhone spyware variant that can remotely extract cryptocurrency wallet data and sensitive credentials from compromised devices.

Security firm iVerify disclosed the malware, designated P7 DarkSword, on Oct. 8 after investigating an infection detected in August. The variant includes commands that specifically target cryptocurrency wallet apps and can collect passwords, photos, and personal information.

The discovery highlights an emerging risk for crypto holders who rely on mobile wallets: attackers who gain access to the underlying device could obtain sensitive information without exploiting a vulnerability in the wallet app itself.

According to iVerify's technical investigation, P7 includes two dedicated functions to identify and collect cryptocurrency-related information.

The first, wallet_scan , searches compromised devices for installed wallet applications, allowing attackers to identify potential targets.

The second, wallet_extract , is designed to collect data associated with imToken, a cryptocurrency wallet supporting multiple blockchain networks.

Together, the commands let attackers identify cryptocurrency users and retrieve wallet-related files after gaining access to their phones.

The spyware also targets Apple's Keychain, the system used to store passwords, authentication credentials, and other sensitive information.

From an on-chain analytics and liquidity distribution perspective, developments around "New iPhone spyware can hunt for crypto wallets and extract their data every 15 seconds" signal important shifts in network participation. Market participants observe that derivative funding metrics, exchange reserve telemetry, and smart contract protocol interactions reflect cautious accumulation alongside disciplined risk hedging across the sector.

Technical research analysts at CryptoAce VIP note that high-density order book clusters and volume-weighted average price (VWAP) benchmarks near recent consolidation floors will serve as pivotal indicators. Market observers are advised to cross-examine telemetry on verified block explorers before making capital allocations.

Editorial Fact-Check & Verification Note: This briefing was curated, corroborated, and synthesized by the CryptoAce VIP Editorial Desk. Readers following "New iPhone spyware can hunt for crypto wallets and extract their data every 15 seconds" are encouraged to review the full primary source coverage linked below for complete historical context, direct quotes, and official statements.