13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
Trojanized Packagist themes inject JavaScript into Vietnamese streaming sites, exploiting unpatched iPhone WebKit and kernel flaws to install spyware and steal crypto wallet seeds.
Socket researchers found 13 malicious Composer theme packages across five vendor namespaces (including vsmov, vsphim, and ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. On iPhones running iOS 18.4-18.6.x, the injected code fires a WebKit-to-kernel exploit chain using CVE-2025-31277 and CVE-2025-43529, pivoting through the GPU process and the AppleM2ScalerCSCDriver IOKit user client to gain kernel read/write. Since around August 12, 2026 the payload also steals cryptocurrency wallet seeds and mnemonics from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX, alongside keychain databases, Wi-Fi passwords, SMS, photos, cookies, and location history, uploaded via HTTPS to rotating C2 domains. The group is believed to be Vietnamese-operated, hosts exploits on Funnull infrastructure, and Apple patched the kernel escape flaw in iOS and macOS 26.1.
- 13 trojanized Composer theme packages across five namespaces inject JavaScript into Vietnamese streaming sites
- iOS chain exploits WebKit CVE-2025-31277 and CVE-2025-43529, then pivots to kernel via AppleM2ScalerCSCDriver
- New payload since August 12, 2026 steals wallet seeds from Bitget, Phantom, Trust Wallet, OKX and others
- Spyware exfiltrates keychain, Wi-Fi passwords, SMS, photos, cookies and location history over HTTPS
- OphimCMS and KKPhim operators urged to remove packages, rotate credentials and audit theme scripts
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1203 Exploitation for Client ExecutionT1555 Credentials from Password StoresT1005 Data from Local SystemT1041 Exfiltration Over C2 Channel
- Countries
- Vietnam
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-31277 | Buffer Overflow in Apple WebKit (Safari, iOS/iPadOS, macOS, WebKitGTK, WPE) | 8.8 | 2% | KEVPoC | KEV |
| CVE-2025-43398 | The issue was addressed with improved memory handling | 5.5 | <1% | ||
CVE-2025-43510+1 related CVE | Improper Locking Memory Corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 group max | <1% | KEV | KEV |
| CVE-2025-43529 | Use-After-Free in Apple WebKit (Safari, iOS, macOS) Allows Arbitrary Code Execution | 8.8 | 26% | KEV | KEV |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites that install those libraries and initiate the deployment of spyware aimed at unpatched iOS devices.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.