OKX

Mentions · 7d0
Mentions · 30d0
All mentions2
First seenAug 20, 2026
Last mentionedSep 2, 2026

Timeline

2 articles · newest first

13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Trojanized Packagist themes inject JavaScript into Vietnamese streaming sites, exploiting unpatched iPhone WebKit and kernel flaws to install spyware and steal crypto wallet seeds.

The Hacker NewsSep 2, 06:24 UTC · Sep 2, 2026Exploit / PoCExploitedCVE-2025-31277 CVE-2025-43529 CVE-2025-43398+26 · 2 reads

40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets

Socket found 40 malicious Firefox extensions impersonating OKX, Rabby Wallet, and TronLink to steal cryptocurrency wallet recovery phrases and private keys.

The Hacker NewsAug 20, 08:42 UTC · Aug 20, 2026MalwareExploited1 · 1 read

Related CVEs

by mentions

CVE-2025-4352926%8.8
Use-After-Free in Apple WebKit (Safari, iOS, macOS) Allows Arbitrary Code Execution
published Dec 17, 2025Apple SafariKEV
CVE-2025-312772%8.8
Buffer Overflow in Apple WebKit (Safari, iOS/iPadOS, macOS, WebKitGTK, WPE)
published Jul 30, 2025Apple SafariKEVPoC
CVE-2025-43510<1%7.8
Improper Locking Memory Corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS
published Dec 12, 2025Apple iPhone OS (iOS)KEV
CVE-2025-43520<1%5.5
Kernel Buffer Overflow (Memory Corruption) in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS
published Dec 12, 2025Apple iPhone OS (iOS)KEV
CVE-2025-43398<1%5.5
The issue was addressed with improved memory handling
published Nov 4, 2025apple ipados

Appears with

Socketvendor · 2
Trust Walletvendor · 1
Funnullvendor · 1
The Hacker Newsorganization · 1
Applevendor · 1
KKPhimvendor · 1
OphimCMSvendor · 1
Bitgetvendor · 1
Supabaseproduct · 1
WebKitproduct · 1
Firefox Add-onsproduct · 1
Cloudflare Workersproduct · 1
Phantomvendor · 1
TronLinkvendor · 1
Mozillavendor · 1
API-Sportsproduct · 1

Entities are extracted by the model from each article. First seen Aug 20, 2026, last mentioned Sep 2, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.