13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
13 malicious Composer theme packages on Packagist were identified, posing as OphimCMS themes to inject JavaScript into Vietnamese streaming sites The injected code executes a dual attack: mobile ad-fraud/gambling redirects for all visitors, and a WebKit-to-kernel exploit chain specifically targeting unpatched iPhones The iOS exploit chain weaponizes CVE-2025-31277 and CVE-2025-43529 to escape the WebContent sandbox, pivot through the GPU process, and achieve kernel-level read/write privileges vi
Analysis
TL;DR
- 13 malicious Composer theme packages on Packagist were identified, posing as OphimCMS themes to inject JavaScript into Vietnamese streaming sites
- The injected code executes a dual attack: mobile ad-fraud/gambling redirects for all visitors, and a WebKit-to-kernel exploit chain specifically targeting unpatched iPhones
- The iOS exploit chain weaponizes CVE-2025-31277 and CVE-2025-43529 to escape the WebContent sandbox, pivot through the GPU process, and achieve kernel-level read/write privileges via AppleM2ScalerCSCDriver IOKit
- The final payload exfiltrates keychain databases, Wi-Fi passwords, SMS, contacts, photos, browser cookies, location history, and cryptocurrency wallet seeds from wallets including Bitget, Phantom, Trust Wallet, and OKX
- The campaign infrastructure is hosted by Funnull, a U.S.-sanctioned entity linked to over $200 million in cryptocurrency losses from romance scams
Why It Matters
This attack demonstrates how supply chain compromises in seemingly unrelated ecosystems (PHP Composer packages) can be weaponized to deliver sophisticated mobile exploits, creating a dangerous bridge between web infrastructure and mobile device compromise. The targeting of cryptocurrency wallet seeds represents a direct financial motivation that could drive significant adoption of similar techniques by threat actors seeking profitable attacks against mobile users.
Technical Details
- Supply Chain Vector: 13 trojanized Composer packages across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) disguised as OphimCMS and KKPhim themes, leveraging "Custom JS" fields to inject malicious code into every page served by compromised streaming sites
- Exploit Chain Architecture: The iOS attack inserts a hidden iframe to detect the iOS version, then loads version-specific exploits targeting CVE-2025-31277 (patched in iOS 18.6) and CVE-2025-43529 (patched in iOS 18.7.3/26.2), analogous to the DarkSword exploit kit
- Privilege Escalation Path: WebContent sandbox → GPU process pivot → kernel escape through AppleM2ScalerCSCDriver IOKit user client → read/write kernel privileges (suspected unpatched vulnerability related to CVE-2025-43398/CVE-2025-43510/CVE-2025-43520, patched in iOS/macOS 26.1)
- Data Exfiltration: Collected data including keychain, Wi-Fi passwords, SMS database, address book, Photos, browser cookies, call history, location history, and account databases are AES-encrypted and uploaded via HTTPS POST to rotating C2 domains, with exploitation progress beaconed to cloudfareintcdn[.]com
- Crypto Wallet Targeting: The August 2026 payload update specifically queries password stores for wallet material from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX, focusing on iOS versions 18.4 through 18.6.x on iPhone XS through iPhone 16
Industry Insight
- Supply Chain Vigilance: Package repository maintainers and developers must implement stricter verification for theme packages, particularly those offering "Custom JS" injection capabilities, as these represent high-impact attack surfaces that can compromise entire websites and their visitors
- Mobile Exploit Economics: The direct financial motivation from cryptocurrency wallet theft suggests this attack pattern will proliferate, with threat actors increasingly targeting mobile devices through web-based exploit chains rather than traditional app store malware
- Patch Management Urgency: The campaign specifically targets devices running iOS 18.4-18.6.x, demonstrating that unpatched WebKit vulnerabilities remain critically exploitable; organizations and users must prioritize iOS updates, especially on older device models that may be deprioritized for security updates
Disclaimer: The above content is generated by AI and is for reference only.