13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
Summary: Socket researchers identified 13 malicious Composer theme packages on Packagist that inject JavaScript into Vietnamese movie and comic streaming sites, running a mobile ad-fraud and gambling-redirect chain and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware. The iOS chain weaponizes CVE-2025-31277 and CVE-2025-43529, pivots from the WebContent sandbox to the GPU process and then the kernel via the AppleM2ScalerCSCDriver IOKit user client, and a redeployment around August 12, 2026 added a stealer for wallet seeds and mnemonics from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX.
Bottom line: A visitor on an iPhone not updated past iOS 18.6.x can have keychain, Wi-Fi passwords, SMS, Photos, contacts, cookies, location history, and wallet seeds exfiltrated just by loading a page in mobile Safari, and the exploit hosts run on Funnull infrastructure, an entity the U.S. sanctioned last May over romance baiting scams tied to over $200 million in cryptocurrency losses.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-31277CVE-2025-43398CVE-2025-43510CVE-2025-43520CVE-2025-43529
- Related
- CVE-2025-31277: Apple Multiple Products Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Mar 20, 2026CVE-2025-43520: Apple Multiple Products Classic Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Mar 20, 2026CVE-2025-43510: Apple Multiple Products Improper Locking Vulnerability Known Exploited Vulnerabilities · Mar 20, 2026