THREATNOIR
Subscribe
Back to advisories

13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Thirteen malicious Composer packages on Packagist have been injected into Vietnamese streaming sites to deploy iOS spyware targeting unpatched iPhones. The campaign, active since March 2026, exploits WebKit vulnerabilities to steal cryptocurrency wallet seeds and execute ad-fraud redirects. Any developer using these packages or users accessing compromised streaming sites face wallet compromise and credential theft.

CRITICALAdvisorySep 01, 2026
Action required
Identify and quarantine any use of malicious Packagist packages in your supply chain. Cross-reference developer environments and production deployments against the IOC list. Scan logs for Composer installations from Packagist between March 2026 and present. Brief finance and crypto-custodian teams on wallet seed exposure risk.
Affected products
ComposerOphimCMSiOSFunnull
Linked articles
Source links