Hackers Use Malicious Website Themes to Steal Crypto Wallet Seeds From iPhones

Cybersecuritynews •Tushar Subhra Dutta • September 1, 2026

Hackers are using booby-trapped website themes to turn visits from iPhone users into a route for spyware and cryptocurrency theft. The campaign hides harmful code inside themes used by Vietnamese movie and comic streaming websites, exposing visitors without warning. The poisoned themes are installed through Composer, a tool developers use to add website components. Once […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Packagist Themes Exploit iPhones for Spyware and Crypto Theft Thirteen malicious Composer theme packages on Packagist have been identified, targeting unpatched iPhones by injecting JavaScript into Vietnamese movie and comic streaming sites. The injected code facilitates mobile ad fraud and gambling redirects, while also deploying a WebKit-to-kernel exploit chain that installs spyware. This campaign is an extension of a previously documented effort that began in March 2026, which initially involved six malicious themes. The exploit leverages two known vulnerabilities, CVE-2025-31277 and CVE-2025-43529, to gain access to sensitive data on affected devices. Apple has confirmed that the kernel escape flaw was patched in iOS and macOS version 26.1. The malicious themes are distributed across five vendor namespaces, affecting a wide range of users. The threat actors have redeployed the iOS exploit chain as of August 12, 2026, specifically targeting iOS versions 18.4 through 18.6.x. Users of these themes are at risk of having their crypto wallet seeds stolen along with other sensitive information. 8 sources 73

Extracted Entities

Hackers Use Malicious Website Themes to Steal Crypto Wallet Seeds From iPhones

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)