Malicious Packagist Themes Exploit iPhones for Spyware and Crypto Theft

• •13 malicious Packagist themes target unpatched iPhones for spyware and crypto theft.
• •Exploits known vulnerabilities CVE-2025-31277 and CVE-2025-43529 to access sensitive data.
• •Apple confirmed the kernel escape flaw was patched in iOS 26.1 before the report.

Thirteen malicious Composer theme packages on Packagist have been identified, targeting unpatched iPhones by injecting JavaScript into Vietnamese movie and comic streaming sites. The injected code facilitates mobile ad fraud and gambling redirects, while also deploying a WebKit-to-kernel exploit chain that installs spyware. This campaign is an extension of a previously documented effort that began in March 2026, which initially involved six malicious themes. The exploit leverages two known vulnerabilities, CVE-2025-31277 and CVE-2025-43529, to gain access to sensitive data on affected devices. Apple has confirmed that the kernel escape flaw was patched in iOS and macOS version 26.1. The malicious themes are distributed across five vendor namespaces, affecting a wide range of users. The threat actors have redeployed the iOS exploit chain as of August 12, 2026, specifically targeting iOS versions 18.4 through 18.6.x. Users of these themes are at risk of having their crypto wallet seeds stolen along with other sensitive information.