Malicious Website Themes Target iPhone Users to Steal Crypto Wallet Seeds

Thirteen malicious website themes distributed through Packagist have been linked to an iPhone spyware campaign designed to steal cryptocurrency wallet seeds and other sensitive data.

The packages were made to look like themes for popular Vietnamese movie and comic streaming platforms. Website operators who installed them could unknowingly expose visitors to malicious code, according to Socket.

The attack mainly targets iPhones running older versions of iOS. When a vulnerable device visits an infected site, the malicious code can attempt to compromise the phone without requiring the user to install a separate app.

Socket said the campaign became more focused on cryptocurrency theft in August, when the attackers updated their spyware to search for recovery phrases and other wallet-related data.

The targeted apps include Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet and OKX.

The spyware can also collect messages, photos, contacts, browser data, saved Wi-Fi passwords and location information before sending stolen data to attacker-controlled servers.

The discovery follows another recent campaign involving 77 malicious Firefox extensions designed to steal recovery phrases, private keys and other wallet information.

Apple has already patched the flaws used in the known attack chain. One of them, CVE-2025-43529, was previously used in what Apple described as sophisticated targeted attacks.

Socket advised website operators to remove packages linked to the affected developer namespaces and urged iPhone users to keep iOS updated, as the known campaign primarily targets devices running older software.