Malicious Website Themes Deliver Spyware, Target iPhone Crypto Wallets
Hackers are exploiting trojanized website themes distributed via Composer to deliver spyware and steal cryptocurrency wallet seeds from iPhones, targeting older iOS versions.
Cybercriminals are leveraging malicious website themes, distributed through the Composer package manager, to deliver spyware and steal sensitive cryptocurrency wallet recovery phrases from iPhone users. The attack chain, detailed by Socket.dev, targets specific WebKit vulnerabilities (CVE-2025-31277, CVE-2025-43529) on older iOS versions, exploiting them to gain deeper device access.
The campaign primarily affects Vietnamese movie and comic streaming websites that utilize these compromised themes. When a website operator installs a trojanized theme, the malicious code is silently delivered to every visitor. While most mobile users are redirected to gambling sites, a subset of iPhone users faces a more sophisticated attack designed to exfiltrate personal data.
The attackers have ingeniously hidden malicious JavaScript loaders within seemingly legitimate theme files. These loaders perform device and referral checks, ignoring desktop browsers and scanners to focus on mobile visitors. For iPhones meeting specific criteria, a secondary loader fetches further code from attacker-controlled infrastructure, identifying the iOS version to deploy a tailored exploit.
This attack vector relies on users running older versions of iOS, specifically those not updated to iOS 18.7.3 or iOS 26.2 and later. The exploits target known WebKit flaws that Apple has since patched, indicating that the attackers are capitalizing on delayed software updates rather than discovering new zero-days.
Once the spyware gains the necessary access, it systematically collects a wide range of sensitive information, including keychain databases, Wi-Fi passwords, text messages, contacts, photos, browser cookies, call history, and location data. This exfiltrated data is then encrypted and transmitted to a network of command-and-control servers.
A more alarming development observed in August is the addition of a focused wallet-theft capability. The spyware actively searches the iPhone's keychain for seed phrases and mnemonic information associated with cryptocurrency wallets. The recovery words, if obtained, grant attackers full control over the victim's digital assets, significantly increasing the potential financial damage.
The attackers have demonstrated a pattern of refreshing filenames and staging components while maintaining access to older files, complicating detection and takedown efforts. This tactic mirrors other supply chain attacks where seemingly innocuous dependencies can quietly harvest valuable secrets.
Website operators are urged to remove untrusted themes, scrutinize front-end scripts, rotate credentials, and monitor network activity. Developers should pin and review Composer dependencies, and security teams should prioritize updating iPhones to the latest iOS versions to mitigate this threat. The campaign serves as a stark reminder that software supply chain attacks can have far-reaching consequences for both developers and end-users.