Booby-trapped Composer packages hijack Vietnamese streaming sites to hit old iPhones
Thirteen fake theme libraries on Packagist quietly loaded ad-fraud scripts and pushed spyware at visitors running unpatched iOS, researchers say.
Key points
- Researchers found 13 malicious Composer theme packages on Packagist, the main library repository for PHP developers, that injected hostile JavaScript into any site that installed them.
- The packages targeted Vietnamese movie and comic streaming sites, using them as a delivery channel for visitors.
- Two payloads ran against visitors: mobile ad fraud and gambling redirects for most users, and spyware aimed specifically at unpatched iPhones.
- The iOS payload attempted to steal cryptocurrency wallet seed phrases, the recovery words that give full control of a crypto wallet.
- Site owners who installed the packages became unwitting distributors of the attack.
Security researchers have pulled 13 malicious packages from Packagist, the main software library for PHP developers, after finding they were built to poison Vietnamese streaming sites and attack their visitors.
The packages were dressed up as Composer themes. Composer is the tool PHP developers use to pull in third-party code, a bit like an app store for website building blocks. When a site owner installed one of these themes, they got working design files and a hidden extra: JavaScript that ran in every visitor's browser. The campaign was first reported by The Hacker News.
What did the malicious code actually do?
It ran two attacks on anyone visiting an infected site. Most visitors were pushed toward mobile ad fraud and gambling sites, the kind of low-grade scheme that quietly racks up fake ad impressions. Visitors on older, unpatched iPhones got something worse: spyware designed to hunt for cryptocurrency wallet seed phrases.
A seed phrase is the list of recovery words a crypto wallet issues at setup. Anyone with those words can drain the wallet from anywhere in the world. Stealing them is the crypto equivalent of copying someone's house keys and their address at the same time. Our story from 6 August on a 12-year-old flaw in CryptoJS that drained $5.7 million from wallets shows how reliably seed-phrase theft converts into real losses.
Who was targeted?
The attackers picked their ground carefully. Vietnamese movie and comic streaming sites tend to draw large mobile audiences, and many of those users hold on to iPhones long past the point Apple stops shipping security updates. That gap, an old phone still browsing the modern web, is exactly what the spyware needed. Apple closed a wave of relevant browser-engine holes as recently as 18 August, as we reported here.
Site owners were the first victims. They installed what looked like a legitimate free theme and became unwitting distributors of the attack against their own audience.
How the attack was staged
| Stage | What happened |
|---|---|
| Bait | 13 fake theme packages published on Packagist |
| Install | Vietnamese streaming site owners added the packages |
| Injection | Hidden JavaScript loaded on every page |
| Payload A | Ad fraud and gambling redirects for general visitors |
| Payload B | Spyware targeting unpatched iOS, aimed at crypto wallet seed phrases |
What should site owners and visitors do?
If you run a PHP site and pulled in any Composer themes from unfamiliar publishers this year, audit your dependencies. Look for JavaScript loading from domains you don't recognise, remove any flagged packages your security vendor lists, and rotate credentials that touched the affected environment.
For iPhone users who've been deferring updates: install the latest iOS your device supports now. If your phone can't receive updates and you hold cryptocurrency on it, move the wallet to a patched device and treat the seed phrase as potentially exposed if you've visited streaming sites of unclear provenance.
Packagist removes malicious packages once they're flagged, but open publishing with light vetting keeps producing these incidents. Supply-chain attacks through developer libraries are now a routine way to reach end users who never knew the library existed. That's the part worth watching: the victims here weren't developers who made careless choices, they were ordinary people who visited a streaming site.
