Malicious Packagist themes deliver iPhone spyware
SecurityOnline reports that malicious website themes can expose iPhone visitors to spyware. The spyware reportedly steals device data and cryptocurrency wallet recovery phrases.
- Report priority
- Medium
How it works
- A site operator must first install a malicious Composer theme from one of the named Packagist publishers.
- The documented loader targets mobile visitors arriving from another site and skips direct visits.
- On eligible iPhones, it checks the iOS version and selects browser exploits.
- The chain gains access to browser memory, moves through the graphics process and reaches the operating system's core, allowing spyware to collect and upload sensitive data.
What to do
Site maintainers should inspect composer.json, composer.lock, and the installed package list for the five namespaces above, then review deployed JavaScript for unexpected loaders. A matching package means the site may have delivered malicious code, not that every visitor was infected. iPhone owners or their IT team should check the installed iOS release and compare it with the affected range above. A vulnerable version indicates exposure is possible, not proof of compromise.
Site maintainers should remove packages from the named namespaces and verify that their dependency files and deployed JavaScript no longer contain them or their loaders. iPhone owners should install the latest update offered for their device. SecurityOnline says the known browser entry points were resolved in iOS 18.7.3 and iOS 26.2. Updating or removing a package doesn't establish that an earlier compromise was removed.
Technical details
A Vietnamese movie streaming site installs a free theme package through Composer without knowing it is compromised. Every mobile visitor to that site now loads hidden JavaScript. On an iPhone still running iOS 18.6.x, the script silently loads exploit code that breaks out of Safari, reaches the kernel through a known flaw Apple already fixed in iOS 26.1, then starts pulling data and crypto wallet recovery phrases off the phone.
SecurityOnline, citing Socket researchers, reports a browser-to-kernel exploit chain delivered by 13 malicious Composer packages. The payload reportedly collects keychain databases, messages, contacts, cookies, call history, location, photos, and Wi-Fi passwords before uploading encrypted files. An August 2026 update reportedly searches for Bitget, Phantom, Trust Wallet, and OKX recovery phrases. The operation is hosted on FUNNULL infrastructure, but the article says independent tenants may be responsible.