High 8.8
KEV-listed
CVE-2025-31277
P7 DarkSword Exploitation Kit Targets Apple iOS Devices
Vendor / product: Apple iOS
Event date: 2025-11-01
Public PoC: Yes
First tracked by RiskWire: 2026-10-12
CISA KEV catalog
Added to KEV
Federal remediation due
2026-04-03 (192 days overdue)
Ransomware campaign use
Unknown
CISA description
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Named threat actors
Russian FSB-linked group (Star Blizzard)
Sources & citations (8)
- P7 DarkSword: iPhone-Malware prüft alle 15 Sekunden auf Befehle ad-hoc-news.de · 2026-10-11
- P7 DarkSword iOS Exploit Kit Steals Crypto Wallets and Keychains techjuice.pk · 2026-10-12
- Warnung vor der P7 DarkSword-Malware auf iOS: Stehlt unbemerkt Schlüsselbundpasswörter und Kryptowährungs-Wallets. vietnam.vn · 2026-10-11
- Spyware P7 DarkSword đánh cắp dữ liệu ví tiền số và chuỗi khóa trên iPhone vnreview.vn · 2026-10-12
- Varianta P7 DarkSword atacă iPhone-uri cu furt de crypto și comenzi la distanță rol.ro · 2026-10-11
- iPhone Spyware Polls Attacker Infrastructure Every 15 Seconds by Default, Can Scan Crypto Wallets tokenpost.com · 2026-10-11
- Phát hiện mã độc P7 DarkSword tấn công iPhone: Nguy cơ lộ... baolamdong.vn · 2026-10-11
- Phát hiện mã độc P7 DarkSword tấn công iPhone: Nguy cơ lộ mật khẩu Keychain và ví điện tử baomoi.com · 2026-10-11
References
See CVE-2025-31277 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →