Researchers have uncovered a coordinated malware campaign targeting iOS users through compromised Packagist packages. The attack chain exploits Vietnamese streaming platforms to distribute spyware capable of stealing cryptocurrency wallet seeds from unpatched iPhones.
Security analysts discovered 13 malicious Composer theme packages hosted on Packagist, the primary PHP package repository. These packages appear legitimate but contain obfuscated JavaScript designed to inject malicious code into websites that integrate them. The targeted sites focus on Vietnamese movie and comic streaming services, platforms with significant mobile traffic.
The injected code performs two distinct operations. First, it executes mobile ad-fraud schemes that generate fraudulent advertising impressions. Second, it redirects visitors to gambling sites, earning referral commissions for attackers. More dangerously, the JavaScript establishes conditions for deploying spyware specifically against iOS visitors using unpatched devices.
The spyware targets cryptocurrency wallet applications, specifically seeking to extract seed phrases and private keys. Seed phrases function as master passwords for wallet recovery and funds transfer. Theft of these credentials grants attackers full control over victims' digital assets. Cryptocurrency holders store substantial value in mobile wallets, making them high-value targets for financially motivated threat actors.
The attack pattern reflects an established supply chain compromise strategy. Attackers uploaded apparently benign theme packages to Packagist, the trusted repository where PHP developers obtain dependencies. Developers installing these packages unknowingly introduced malicious code into their website infrastructure. This approach exploits the trust implicit in curated package repositories. Unlike random malware distribution, supply chain attacks achieve broad deployment through legitimate development workflows.
Vietnamese streaming services represent a logical attack vector. These platforms attract millions of mobile users daily, and their operators may lack enterprise-grade security operations. Streaming sites frequently rely on third-party PHP libraries and themes for rapid development. Less mature security practices increase the likelihood that malicious packages slip through vetting processes.
The iOS targeting reflects attackers' understanding of cryptocurrency user behavior. iOS devices command premium pricing and user loyalty, correlating with higher cryptocurrency adoption rates among Apple users. Targeting unpatched devices exploits a known vulnerability window. iOS users who delay security updates create exploitable conditions for spyware deployment.
The attack chain requires user interaction but remains effective. Victims must visit infected Vietnamese streaming sites through mobile Safari or in-app browsers. The injected JavaScript then attempts to exploit unpatched iOS vulnerabilities to install persistent spyware. Users running current iOS versions may face reduced risk, though no exploit details have surfaced publicly yet.
Packagist has removed the identified malicious packages following researcher notification. However, the discovery raises questions about package repository security screening. Packagist maintainers rely partly on community reporting and automated scanning rather than pre-publication security audits. This reactive approach creates time windows during which malicious packages remain accessible.
Organizations running Vietnamese streaming services or similar platforms should audit their Composer dependencies immediately. Developers should review package installation histories and enable security scanning in their CI/CD pipelines. End users should apply pending iOS security updates without delay, particularly those managing cryptocurrency assets on mobile devices.
The incident demonstrates how attackers weaponize seemingly innocent PHP packages to target mobile cryptocurrency users. Supply chain compromise remains an effective attack vector because developers inherently trust repositories they depend on for core functionality.