13 Malicious Packagist Themes Exploit iPhone Vulnerabilities to Steal Crypto Wallet Seeds

Gbhackers •Mayura Kathir • September 1, 2026

13 malicious Composer theme packages on Packagist that turn Vietnamese movie and comic streaming websites into delivery points for iPhone spyware, gambling redirects, ad fraud, and cryptocurrency-wallet theft. Once an operator installs one of the trojanized themes through Composer, the bundled front-end JavaScript is served to every visitor. Mobile users are selectively targeted, while iPhone […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Packagist Themes Exploit iPhones for Spyware and Crypto Theft Thirteen malicious Composer theme packages on Packagist have been identified, targeting unpatched iPhones by injecting JavaScript into Vietnamese movie and comic streaming sites. The injected code facilitates mobile ad fraud and gambling redirects, while also deploying a WebKit-to-kernel exploit chain that installs spyware. This campaign is an extension of a previously documented effort that began in March 2026, which initially involved six malicious themes. The exploit leverages two known vulnerabilities, CVE-2025-31277 and CVE-2025-43529, to gain access to sensitive data on affected devices. Apple has confirmed that the kernel escape flaw was patched in iOS and macOS version 26.1. The malicious themes are distributed across five vendor namespaces, affecting a wide range of users. The threat actors have redeployed the iOS exploit chain as of August 12, 2026, specifically targeting iOS versions 18.4 through 18.6.x. Users of these themes are at risk of having their crypto wallet seeds stolen along with other sensitive information. 8 sources 73

Extracted Entities

13 Malicious Packagist Themes Exploit iPhone Vulnerabilities to Steal Crypto Wallet Seeds

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)