Booby-trapped Composer packages hijack Vietnamese streaming sites to hit old iPhones
Thirteen fake theme libraries on Packagist quietly loaded ad-fraud scripts and pushed spyware at visitors running unpatched iOS, researchers say.
Key points
- Researchers found 13 malicious Composer theme packages on Packagist, the main library repository for PHP developers, that injected hostile JavaScript into any site that installed them.
- The packages targeted Vietnamese movie and comic streaming sites, using them as a delivery channel for visitors.
- Two payloads ran against visitors: mobile ad fraud and gambling redirects for most users, and spyware aimed specifically at unpatched iPhones.
- The iOS payload attempted to steal cryptocurrency wallet seed phrases, the recovery words that give full control of a crypto wallet.
- Site owners who installed the packages became unwitting distributors of the attack.
Security researchers have pulled 13 malicious packages from Packagist, the main software library for PHP developers, after finding they were built to poison Vietnamese streaming sites and attack their visitors.
The packages were dressed up as Composer themes. Composer is the tool PHP developers use to pull in third-party code, a bit like an app store for website building blocks. When a site owner installed one of these themes, they got working design files and a hidden extra: JavaScript that ran in every visitor's browser.
The campaign was first reported by The Hacker News.
What did the malicious code actually do?
It ran two attacks on anyone visiting the infected site. Most visitors were pushed toward mobile ad fraud and gambling sites, the kind of low-grade money-making scheme that quietly racks up fake ad impressions. Visitors on older, unpatched iPhones got something worse: spyware designed to hunt for cryptocurrency wallet seed phrases.
A seed phrase is the list of 12 or 24 recovery words that a crypto wallet gives you when you set it up. Anyone with those words can drain the wallet from anywhere in the world. Stealing them is the crypto equivalent of copying someone's house keys and their address at the same time.
Who was targeted?
The hackers picked their ground carefully. Vietnamese movie and comic streaming sites tend to draw large mobile audiences, and many of those users hold on to iPhones long past the point Apple stops shipping security updates for them. That gap, an old phone still browsing the modern web, is exactly the gap the spyware needed.
Site owners were the first victims. They installed what looked like a legitimate free theme and became unwitting distributors of the attack against their own audience.
How the attack was staged
| Stage | What happened |
|---|---|
| Bait | 13 fake theme packages published on Packagist |
| Install | Vietnamese streaming site owners added the packages |
| Injection | Hidden JavaScript loaded on every page |
| Payload A | Ad fraud and gambling redirects for general visitors |
| Payload B | Spyware targeting unpatched iOS, aimed at crypto wallet seed phrases |
What should site owners and visitors do?
If you run a PHP site and pulled in any Composer themes from unfamiliar publishers this year, audit your dependencies. Look for JavaScript that loads from domains you do not recognise, and remove any of the flagged packages your security vendor lists. Rotate any credentials that touched the affected environment.
If you use an iPhone and have been putting off updates, install the latest iOS your device supports. If your phone is too old to receive updates and you hold cryptocurrency on it, move the wallet to a device that still gets patches, and treat the seed phrase as potentially exposed if you have visited streaming sites of unclear provenance.
Packagist has a track record of removing malicious packages once flagged, but the model, open publishing with light vetting, keeps producing these incidents. Supply-chain attacks through developer libraries are now a routine way to reach end users who never knew the library existed.
