13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

Socket’s Threat Research Team found 13 malicious Composer theme packages on Packagist, published across five vendor namespaces, that inject JavaScript into every page of the Vietnamese movie and comic streaming sites that install them. The injected code runs two operations against a site’s visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware.

We reported the iOS chain to Apple and coordinated disclosure. Apple confirmed the kernel escape was already fixed in iOS and macOS 26. 1 before our report, and the two WebKit entry points are public and listed in CISA's Known Exploited Vulnerabilities catalog.