The injected script performs two distinct operations against site visitors: it redirects users to mobile ad-fraud schemes and gambling pages, while simultaneously attempting to deploy spyware on vulnerable iOS devices. The spyware is specifically crafted to extract cryptocurrency wallet seed phrases from compromised iPhones.

Key details from the analysis:

• 13 malicious theme packages were uploaded to Packagist, the official PHP package repository.
• The payload targets unpatched iOS devices, meaning iPhones that have not received the latest security updates.
• The attack chain begins with the installation of a malicious Composer theme package on a streaming website.
• Once live, the injected JavaScript runs dual operations: ad-fraud and gambling redirects, alongside spyware deployment.
• The ultimate goal of the spyware is to harvest crypto wallet seeds, giving attackers full control over victims’ digital assets.

Affected parties should audit any Composer dependencies sourced from Packagist, especially theme packages used in Vietnamese-language streaming services, and verify the integrity of their installed libraries. For iOS users, applying the latest system updates remains a critical defense against this type of exploit chain.

Source: The Hacker News

Is your team reviewing Composer package integrity before every deployment, or do you rely on post-install audits to catch malicious dependencies?