Infected PHP Themes on Streaming Sites: The iOS Chain That Empties Crypto Wallets

An iPhone visiting a Vietnamese streaming site can expose seed phrases and private keys for seven cryptocurrency wallets. Not because of a malicious app downloaded from the App Store, but because of a hidden iframe loaded by a legitimate PHP theme infected upstream. Research from Socket, published September 13, 2026 via The Hacker News, documents this chain. A parallel alert from SlowMist, issued six days later, raises questions about the attack's scope that remain unanswered.

Note on source limitations: This analysis rests on a single structured primary source: Socket's research via The Hacker News. NVD records and the Apple advisory supplement CVE data but do not independently confirm the exploit chain. The SlowMist alert of September 19, 2026 may refer to the same Packagist campaign or to separate activity. The iOS 13–26.5 range cited by SlowMist has not been independently verified.

"CVE-2025-43510: CVSS 7.8 HIGH, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — the most severe of the three suspected kernel CVEs, with CISA confirmation of active exploitation"

The Vector: Streaming Sites Turned Into Unwitting Vectors

Socket researchers, with Kush Pandya cited as the researcher, identified thirteen Packagist packages distributed across five vendor namespaces. The packages posed as themes for OphimCMS and affiliated streaming platforms. Site operators installed them legitimately, unaware of the injected JavaScript component.

The injected code performs two operations. The first is a chain of advertising and gambling redirects, active for all mobile visitors. The second, active only on iPhone, loads a hidden iframe with the iOS exploit chain. The distinction by device and OS version occurs server-side.

"Every mobile visitor is also subject to the gambling-redirect and ad-injection chain. The site operators are victims too: they shipped the trojanized theme unknowingly and served the payload to their own users." — Kush Pandya, Socket security researcher, via The Hacker News

From Browser to Kernel: The Documented Exploit Chain

The Socket research documents a technical progression reminiscent of the DarkSword exploit kit architecture. The first phase exploits CVE-2025-31277, a memory vulnerability in WebKit patched in iOS 18.6, and CVE-2025-43529, a vulnerability in JavaScriptCore patched in iOS 18.7.3 and iOS 26.2. This initial phase enables arbitrary read and write from JavaScript.

From there the chain proceeds with a bypass of Pointer Authentication Codes, Apple's hardware defense mechanism. Overcoming PAC enables native code execution. Next comes the escape from the WebContent sandbox, which isolates the browser process, and finally escalation to kernel privileges.

For the final kernel escalation phase, Socket researchers identified three suspected CVEs: CVE-2025-43398, CVE-2025-43510, and CVE-2025-43520. According to NVD records, all three were patched in iOS 18.7.2 and iOS 26.1. The brief does not specify which of the three corresponds to the kernel escape actually exploited in the campaign. Apple fixed the kernel component in iOS 26.1 without assigning a specific CVE to that fix.

CVE-2025-43510 carries the highest CVSS of the three: 7.8 HIGH with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, per the NVD record. The AV:L vector indicates the exploit requires local access, with user interaction (UI:R). CVE-2025-43520 and CVE-2025-43398 have lower scores. CVE-2025-43510 and CVE-2025-43520 appear in the CISA KEV catalog, added March 20, 2026, with a mitigation deadline of April 3, 2026.

The Payload: Seven Wallets in the Crosshairs

Once kernel privileges are obtained, the malware installs spyware and activates the cryptocurrency wallet theft module. According to Socket research, the payload queries the iOS password store for materials associated with: Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX. The targets are seed phrases and private keys.

"The malware queries the password store for wallet material from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX." — The Hacker News, reporting Socket research

The command-and-control infrastructure is hosted on Funnull, an entity sanctioned by the U.S. Treasury Department in May 2026. According to The Hacker News, Funnull is associated with romance baiting scams with total losses exceeding $200 million in cryptocurrency. The dossier does not document direct operational overlap between the two strands.

SlowMist and Socket: Same Campaign or Parallel Alerts?

On September 19, 2026, SlowMist, via CISO 23pds, issued a public alert on a full-chain iOS exploit for crypto key theft. SlowMist indicated a presumed affected version range of iOS 13 to iOS 26.5, specifying that final confirmation is pending.

The Socket research, published six days earlier, documents a redeployment of the exploit chain with a new payload occurring approximately August 12, 2026, targeting iOS versions 18.4 through 18.6.x. This discrepancy in version ranges — 18.4–18.6.x for Socket, 13–26.5 presumed for SlowMist — prevents establishing with certainty whether the two alerts describe the same campaign or distinct activity. The brief lists this relationship as UNKNOWN. The article cannot present them as probably the same without support.

For clarity: the FomoPeek incident, cited in the brief as explicitly correlated NOT to be confused, involves a malicious app distributed via the App Store. It is a different vector from the browser exploit documented by Socket.

What to Do Now

For users with wallets on iOS devices, updating to iOS 18.7.2 or iOS 26.1 is the documented countermeasure from Apple for the three suspected CVEs. The brief does not specify the patch status of intermediate versions.

The presence of CVE-2025-43510 and CVE-2025-43520 in the CISA KEV catalog imposes a mitigation deadline of April 3, 2026 for U.S. federal agencies. This indicator confirms active exploitation of the vulnerabilities in general, not specifically for the Packagist campaign documented by Socket.

For users who visit Vietnamese streaming sites or use platforms with Composer themes, checking the installed iOS version remains the priority documented action. The brief does not specify additional verifiable countermeasures.

Editorial Position

The editorial team assesses that the campaign documented by Socket and the SlowMist alert are potentially linked but not demonstrably identical. The divergent version ranges, the lack of cross-confirmation between the two sources, and the brief's explicit UNKNOWN status require this caution. The Socket research remains the only structured source with verifiable technical details on the Packagist chain. The SlowMist alert, while thematically related, requires independent verification before being integrated into the same narrative.

Information has been verified against cited sources and is current as of publication.

Sources

• https://coinfomania.com/hackers-exploit-ios-vulnerabilities-to-steal-private-keys/
• https://coinspectator.com/mainstream/2026/09/19/every-iphone-user-should-update-their-ios-to-protect-your-tiny-coins/
• https://fxdailyreport.com/slowmist-warns-iphone-users-of-crypto-key-stealing-exploit/
• https://thehackernews.com/2026/09/13-malicious-packagist-packages-target.html
• https://www.panewslab.com/en/articles/01a0be34-34b1-7556-910d-f589a842e3be
• https://nvd.nist.gov/vuln/detail/CVE-2025-43398
• https://nvd.nist.gov/vuln/detail/CVE-2025-43510
• https://nvd.nist.gov/vuln/detail/CVE-2025-43520
• https://support.apple.com/en-us/125632
• https://thehackernews.com/