13 Malicious Theme Packages Target Unpatched iPhones for Crypto Wallet Seeds

Cybersecurity researchers have identified a set of malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites. These libraries initiate the deployment of spyware aimed at unpatched iOS devices.

The injected code runs two operations against a site's visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware. The activity is assessed to be part of a campaign first documented by the application security company back in March 2026.

The iOS attack chain is designed to insert a hidden iframe element that determines the iOS version and loads an operating system-specific version of the exploit. It weaponizes two WebKit vulnerabilities -- CVE-2025-31277 (Patched in version 18.6) and CVE-2025-43529 (Patched in versions 18.7.3 and 26.2).