13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

Socket researchers identified 13 malicious Packagist Composer themes, published under five vendor namespaces, that target Vietnamese movie and comic streaming sites using OphimCMS and KKPhim by embedding harmful JavaScript in front-end assets. The code directs mobile visitors to gambling and advertising-fraud pages and, for externally referred visitors using unpatched iPhones, can launch a multi-stage WebKit-to-kernel exploit chain that installs spyware. The spyware reportedly collects sensitive device information including keychain data, messages, photos, contacts, browser data, location history, Wi-Fi passwords, account databases, and, in a later redeployment, cryptocurrency wallet seeds for several wallet applications. The exploits target iOS 18.4 through 18.6.x devices and rely on vulnerabilities Apple has patched, with the kernel escape addressed in iOS and macOS 26.1 and WebKit entry points fixed in later iOS updates. Researchers linked the delivery infrastructure to FUNNULL, a sanctioned hosting provider used by multiple apparently independent criminal tenants, while attributing the theme-publishing operation more specifically to a Vietnamese-operated group without claiming a shared identity with other FUNNULL users. The report recommends that affected site operators remove themes from the named vendors, inspect systems and scripts, rotate credentials, and that users update affected iPhones and organizations monitor or block the identified malicious infrastructure.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.