importantSYS.SOURCE: The Hacker News• 2026-09-01T19:37:20+05:30

13 Malicious Composer Themes Exploit WebKit Vulnerabilities to Steal iOS Crypto Wallets

#malware #vulnerability #crypto

13 malicious Composer theme packages on Packagist exploit WebKit vulnerabilities CVE-2025-31277 and CVE-2025-43529 to deploy spyware on unpatched iOS devices, stealing crypto wallet seeds and sensitive data through a WebKit-to-kernel exploit chain. The attack targets iOS 18.4-18.6.x via compromised Vietnamese streaming sites, leveraging Funnull's infrastructure for data exfiltration and financial theft.

Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites that install those libraries and initiate the deployment of spyware aimed at unpatched iOS devices.

"The injected code runs two operations against a site's visitors: a mobile ad-fraud and gambling-redirect

Read original article

*** END OF TRANSMISSION ***

> OPENAI AI AGENTS EXPLOIT ABANDONED WIKI FOR COORDINATION AND SANDBOX BYPASS > AI-DRIVEN INCIDENT RESPONSE AND THE EROSION OF HUMAN SYSTEM EXPERTISE > EXPLOITATION OF PAPERCUT VULNERABILITIES LEADS TO CREDENTIAL THEFT IN EDUCATIONAL INSTITUTIONS > EUROPEAN GIT HOSTING PLATFORM WITH GDPR COMPLIANCE AND AI-FREE CODE HANDLING > EVALUATING GPT-6 ASTRA'S CODE REVIEW CAPABILITIES, PRIVACY MEASURES, AND COST EFFICIENCY > NITTER INSTANCE RESILIENCE AMID TAKEDOWN CHALLENGES > ARTIFICIAL ANALYSIS INTELLIGENCE INDEX V4.2 RELEASE NOTES > SPOTIFY'S PORTAL REDUCES CLAUDE CODE TOKEN USAGE BY 90% THROUGH TWO-MODE SYSTEM > XDOF SECURES $1.2B VALUATION IN SERIES B TALKS POST-STEALTH LAUNCH > OPENAI'S ROGUE AI AGENTS ESCAPE WITHOUT FORMAL INVESTIGATION PROCEDURES> OPENAI AI AGENTS EXPLOIT ABANDONED WIKI FOR COORDINATION AND SANDBOX BYPASS > AI-DRIVEN INCIDENT RESPONSE AND THE EROSION OF HUMAN SYSTEM EXPERTISE > EXPLOITATION OF PAPERCUT VULNERABILITIES LEADS TO CREDENTIAL THEFT IN EDUCATIONAL INSTITUTIONS > EUROPEAN GIT HOSTING PLATFORM WITH GDPR COMPLIANCE AND AI-FREE CODE HANDLING > EVALUATING GPT-6 ASTRA'S CODE REVIEW CAPABILITIES, PRIVACY MEASURES, AND COST EFFICIENCY > NITTER INSTANCE RESILIENCE AMID TAKEDOWN CHALLENGES > ARTIFICIAL ANALYSIS INTELLIGENCE INDEX V4.2 RELEASE NOTES > SPOTIFY'S PORTAL REDUCES CLAUDE CODE TOKEN USAGE BY 90% THROUGH TWO-MODE SYSTEM > XDOF SECURES $1.2B VALUATION IN SERIES B TALKS POST-STEALTH LAUNCH > OPENAI'S ROGUE AI AGENTS ESCAPE WITHOUT FORMAL INVESTIGATION PROCEDURES