Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Seeds
Attackers poisoned PHP dependency libraries to inject spyware into streaming sites, targeting iOS users for cryptocurrency theft.
Cybersecurity researchers have uncovered a supply-chain attack involving 13 malicious Composer theme packages on Packagist designed to target unpatched iPhones. The campaign turns trusted web infrastructure into a delivery system for spyware aimed at stealing cryptocurrency wallet seeds.
The attack begins on Packagist, the primary repository for Composer, the PHP dependency manager. By poisoning these theme packages, attackers can compromise any website that installs the affected libraries. In this specific campaign, the malicious code was injected into Vietnamese movie and comic streaming websites. Once a visitor accesses these sites, the packages deploy JavaScript that executes two primary operations: mobile ad-fraud and redirects to gambling sites.
The Supply-Chain Vector
This method represents a sophisticated bridge between server-side vulnerabilities and client-side exploitation. By compromising the PHP dependencies on the server, the attackers bypass traditional perimeter defenses to deliver malicious payloads directly to the end-user's browser. This allows the attackers to leverage the existing trust between a streaming platform and its audience to facilitate the deployment of more dangerous tools.
Risks to iOS Users
Beyond the immediate nuisance of ad-fraud and gambling redirects, the ultimate objective of the campaign is the deployment of spyware. This software specifically targets unpatched iOS devices to extract cryptocurrency wallet seeds. Because these seeds provide total control over a digital wallet, the successful infection of a single device can lead to the total loss of all stored assets. This highlights a critical risk for mobile users who delay operating system updates, as they remain vulnerable to known exploits that these packages are designed to trigger.
Industry Implications
This campaign underscores the growing danger of dependency poisoning in the PHP ecosystem. When a widely used repository like Packagist is used to distribute malicious code, the blast radius extends far beyond the initial developer to millions of unsuspecting end-users. It demonstrates that supply-chain security is no longer just about protecting the build pipeline, but about protecting the end-user from the infrastructure they trust.
What to Watch
Security teams are now monitoring for similar patterns of JavaScript injection across other regional streaming platforms. While the current focus is on Vietnamese sites, the modular nature of Composer packages suggests the attack could be scaled to other languages or regions. Users are urged to update their iOS devices to the latest version to mitigate the risk of seed theft, while developers are encouraged to audit their Composer dependencies for unauthorized changes.