October 12, 2026
- P7 DarkSword adds wallet theft and full two-way C2 to the leaked iOS exploit kit. iVerify says the variant reduces logging and process injection, prevents repeated exploitation through browser-state checks, extracts keychain data locally, targets cryptocurrency wallets, and polls for remote commands. The underlying DarkSword chain has been used against iOS 18.4–18.7. Separate attempts to port it to iOS 26.x appeared likely LLM-assisted but were largely non-functional. · Threat Activity
in GlobalProtect Auth Bypass Becomes a Ransomware Initial-Access Path