# 13 Malicious Packages Target iPhones to Steal Crypto Wallet Seeds

Vulnerable iPhones are targeted by malicious packages designed to steal cryptocurrency wallet information.

- **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563)
- **Published:** 2026-09-01
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://thehackernews.com/2026/09/13-malicious-packagist-packages-target.html>
- **On Brifing:** https://brifing.si/s/bb664f38-9413-4931-a689-5e8ebe7fdb8e

## Discovery of Malicious Packages

Security researchers identified 13 malicious Composer theme packages on Packagist. These packages inject JavaScript into Vietnamese movie and comic streaming sites, attempting to install spyware on vulnerable iOS devices. The injected code executes mobile ad fraud and gambling redirects for visitors. On iPhones, it initiates an exploit chain from WebKit to the kernel.

## Campaign Origins

This activity is assessed to be part of a campaign first documented in March 2026. Six malicious Packagist packages disguised as OphimCMS themes redirect visitors, exfiltrate URLs, and inject ads. A second-stage payload hosted on Funnull infrastructure directs victims to gambling and adult content sites. The packages span five vendor namespaces, posing a significant threat.

## iOS Exploit Chain

The iOS attack chain inserts a hidden iframe to determine the iOS version and loads an OS-specific exploit payload. It leverages two WebKit vulnerabilities (CVE-2025-31277 and CVE-2025-43529) in a manner similar to the DarkSword exploit kit. The payload escapes the WebContent sandbox into the GPU process and reaches the kernel via the AppleM2ScalerCSCDriver IOKit user client.

## Data Theft

Upon successful exploitation, the final payload uses kernel read privileges to collect keychain databases, Wi-Fi passwords, SMS databases, address books, photos, browser cookies, call history, location history, and account databases. The data is encrypted with AES and uploaded via HTTPS POST to rotating command and control domains. Workers report exploitation progress to cloudfareintcdn[.]com/wd-status.html.

## Cryptocurrency Wallet Theft

Threat actors redeployed the iOS chain in August 2026, targeting devices running iOS 18.4 through 18.6.x. The new payload adds an iOS Keychain cryptocurrency wallet seed and mnemonic stealer. The malware queries password stores for wallet material from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX, extending beyond device data to direct financial theft.

## Additional Packages and Threat

Socket noted that the same five vendor namespaces published additional theme packages without active payloads during analysis. However, these packages are configured to activate malicious code via 'Custom JS' fields rendered on every website page. This setup suggests preparation for potential future attacks.

## Campaign Attribution

The actors behind the campaign remain unidentified, but commit metadata timestamps suggest a Vietnamese-operated group. iOS exploit servers run on infrastructure provided by Funnull, a U.S.-sanctioned entity linked to romance scams causing over $200 million in cryptocurrency losses.

## Mitigation Measures

To counter the threat, site operators using OphimCMS or KKPhim should check for the mentioned packages, remove them if found, rotate credentials, and audit shipped jQuery and theme scripts for compromise indicators. iPhone users must keep devices updated and avoid suspicious websites to mitigate risks.

## Sources covering this story

- https://thehackernews.com/2026/09/13-malicious-packagist-packages-target.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._