Thirteen Malicious Packagist Packages Deploy Spyware Targeting Unpatched iOS Devices

Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites. According to reporting, the injected code runs two primary operations against a site's visitors: mobile ad-fraud and gambling-redirects. Additionally, the malicious payload initiates deployment of spyware aimed at unpatched iOS devices with the objective of stealing cryptocurrency wallet seed phrases. The compromised libraries were distributed through the Packagist repository, and visitors to affected streaming sites who have not applied the latest iOS security updates are at risk of having their crypto assets exfiltrated. The exact method of spyware deployment onto iOS devices and the precise number of affected streaming sites remain unverified. Researchers have advised updating Composer dependencies, applying iOS security patches, and avoiding streaming sites that embed unverified third-party libraries to mitigate the risk.