OTX Threat: 13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

Thirteen malicious Composer theme packages published on Packagist across five vendor namespaces inject JavaScript into Vietnamese movie and comic streaming sites. The injected code executes two operations: a mobile ad-fraud and gambling redirect chain, and on iPhones, a WebKit-to-kernel exploit chain installing spyware. The iOS chain weaponizes CVE-2025-31277 and CVE-2025-43529, targeting devices CVEs: CVE-2025-43529, CVE-2025-31277, CVE-2026-43655