Malicious Packagist packages target unpatched iPhones to steal crypto wallet seeds

Researchers have identified 13 malicious Composer theme packages on Packagist that inject JavaScript into Vietnamese movie and comic streaming sites, deploying spyware on unpatched iPhones and running ad fraud and gambling redirects on mobile visitors.

The iOS attack chain exploits two WebKit vulnerabilities, CVE-2025-31277 and CVE-2025-43529, to escape the sandbox and reach the kernel, ultimately collecting keychain databases, Wi-Fi passwords, SMS, photos, and other sensitive data. A later payload adds a cryptocurrency wallet seed stealer targeting wallets such as Trust Wallet and Phantom.

The campaign is attributed to a Vietnamese-operated group and uses infrastructure from Funnull, an entity sanctioned by the US for facilitating romance baiting scams. Site operators using OphimCMS or KKPhim are advised to check for the malicious packages and rotate credentials.