13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Introduction

Cybersecurity researchers have identified 13 malicious Composer theme packages on Packagist designed to inject JavaScript into Vietnamese movie and comic streaming sites. These compromised packages are being used to steal cryptocurrency wallet seeds, passwords, and sensitive data from unpatched iPhone users.

The campaign, which was first documented in March 2026, has evolved to include WebKit-to-kernel exploit chains that target iOS devices running older, unpatched versions. The malware collects keychain databases, Wi-Fi passwords, SMS, photos, browser cookies, and cryptocurrency wallet seeds — enabling attackers to drain victims' crypto holdings.

The Threat: 13 Malicious Composer Packages

The malicious packages span five vendor namespaces and are designed to look like legitimate theme packages for OphimCMS and KKPhim — popular Vietnamese movie and comic streaming platforms.

Site operators who installed any of these packages unknowingly served the malicious payload to their own visitors. The attackers have also published additional theme packages with dormant malicious code that can be activated remotely.

How the Attack Works

At a high level, the trojanized Composer theme injects JavaScript that performs two primary operations:

1. Mobile ad-fraud and gambling-redirect chain — targets all mobile visitors with redirects to gambling and adult content sites
2. iOS spyware deployment — targets unpatched iPhones with a WebKit-to-kernel exploit chain

The injected JavaScript inserts a hidden iframe that determines the iOS version and loads an operating system-specific version of the exploit. The attack chain is reminiscent of the DarkSword exploit kit.

The iOS Exploit Chain

The iOS attack chain is sophisticated and multi-stage:

1. Hidden iframe insertion — determines the iOS version of the visiting device
2. WebKit exploit — weaponizes CVE-2025-31277 and CVE-2025-43529
3. Sandbox escape — pivots out of the WebContent sandbox into the GPU process
4. Kernel escape — reaches the kernel through the AppleM2ScalerCSCDriver IOKit user client
5. Read/write privileges — obtains kernel read and write privileges
6. Data exfiltration — collects and encrypts sensitive data

Targeted Vulnerabilities

The attack chain weaponizes three key vulnerabilities:

• CVE-2025-31277 — WebKit vulnerability (Patched in iOS 18.6)
• CVE-2025-43529 — WebKit vulnerability (Patched in iOS 18.7.3 and 26.2)
• Kernel escape (Unassigned CVE) — AppleM2ScalerCSCDriver IOKit user client vulnerability (Patched in iOS 26.1 and macOS 26.1)

The attackers have been observed redeploying the entire iOS chain around August 12, 2026, primarily targeting iOS devices running versions 18.4 through 18.6.x.

What Is Stolen?

Upon successful exploitation, the final payload uses kernel read access to collect and exfiltrate:

• Keychain databases — including stored passwords and crypto wallet seeds
• Wi-Fi passwords — saved network credentials
• SMS database — text messages
• Address book — contacts
• Photos — images stored on the device
• Browser cookies — session tokens and authentication data
• Call history — phone call logs
• Location history — GPS and location data
• Account databases — various app account information

The stolen data is encrypted with AES and uploaded via HTTPS POST /upload to a rotating pool of command and control domains.

Cryptocurrency Wallets Targeted

An updated version of the malware adds a new payload that specifically targets iOS Keychain cryptocurrency wallet seeds and mnemonics. The following wallets are targeted:

• Bitget — cryptocurrency exchange wallet
• BitKeep — multi-chain wallet
• Bitpie — cryptocurrency wallet
• Phantom — Solana wallet
• Tonkeeper — TON blockchain wallet
• Trust Wallet — multi-currency wallet
• OKX — cryptocurrency exchange wallet

This represents a significant escalation — attackers are no longer just stealing device data but are directly targeting financial assets.

Who Is Behind the Campaign?

The campaign is believed to be the work of a Vietnamese-operated group based on commit metadata timestamps. The iOS exploit hosts run on infrastructure provided by Funnull, an entity sanctioned by the U.S. in May 2026 for facilitating romance baiting scams that led to over $200 million in cryptocurrency losses.

Funnull's involvement is particularly concerning given its history of enabling large-scale financial fraud and its current role in hosting this sophisticated spyware campaign.

How to Protect Yourself and Your Organization

For iPhone Users:

1. Update your iOS immediately — Ensure you are running iOS 18.7.3, 26.1, 26.2, or later. Do not delay updates.
2. Be cautious of websites — Avoid visiting unfamiliar Vietnamese movie or comic streaming sites.
3. Use a mobile security solution — Consider using reputable mobile security software.
4. Check for suspicious activity — Monitor your crypto wallets for unauthorized transactions.
5. Rotate wallet seeds — If you suspect compromise, transfer funds to new wallets with new seed phrases.

For Website Operators (OphimCMS / KKPhim):

1. Check installed packages — Review your Composer dependencies for any of the malicious packages listed above.
2. Remove malicious packages — Immediately uninstall any compromised themes.
3. Rotate credentials — Change all admin passwords, API keys, and database credentials.
4. Audit jQuery and theme scripts — Review for indicators of compromise.
5. Scan for injected code — Look for hidden iframes or JavaScript that loads external resources.

For Organizations:

• Implement mobile device management (MDM) — Ensure all corporate iOS devices are updated promptly.
• Enforce update policies — Require employees to update to the latest iOS versions.
• Educate employees — Train staff on the risks of visiting compromised websites.
• Monitor network traffic — Look for connections to known malicious domains (e.g., cloudfareintcdn[.]com).

Final Thoughts

The discovery of 13 malicious Packagist packages targeting unpatched iPhones represents a significant threat to both individual users and organizations. The campaign's evolution from ad-fraud redirects to cryptocurrency wallet theft demonstrates the increasing sophistication of cybercriminals.

Key takeaways:

• 13 malicious packages identified on Packagist targeting OphimCMS and KKPhim users
• Sophisticated iOS exploit chain — WebKit-to-kernel escapes targeting unpatched iPhones
• Crypto wallet theft — seeds and mnemonics stolen from multiple wallets
• Funnull infrastructure — sanctioned entity hosting the exploit servers
• Update now — iOS 18.7.3, 26.1, or 26.2 is required for protection
• Check your packages — website operators must audit their Composer dependencies

If you need assistance securing your organization's devices, websites, or IT infrastructure, contact SystemLogicIT for expert guidance.