#ParsedReport #CompletenessHigh
31-08-2026

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

https://socket.dev/blog/packagist-themes-ios-spyware

Report completeness: High

Actors/Campaigns:
Triad_nexus

Threats:
Ioncube_tool
Supply_chain_technique
Dead_drop_technique

Victims:
Vietnamese movie and comic streaming sites, Iphone users, Cryptocurrency wallet users

Industry:
Healthcare

Geo:
Russian, Hong kong, Pacific, Chinese, United states, Turkish, Vietnamese

CVEs:
CVE-2025-31277 [Vulners]
CVSS V3.1: 8.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- apple safari (<18.6)
- apple ipados (<18.6)
- apple iphone_os (<18.6)
- apple macos (<15.6)
- apple tvos (<18.6)
have more...
CVE-2025-43529 [Vulners]
CVSS V3.1: 8.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- apple safari (<26.2)
- apple ipados (<18.7.3, <26.2)
- apple iphone_os (<18.7.3, <26.2)
- apple macos (<26.2)
- apple tvos (<26.2)
have more...
CVE-2026-43655 [Vulners]
CVSS V3.1: 7.3,
Vulners: Exploitation: Unknown
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- apple ipados (<26.5)
- apple iphone_os (<26.5)
- apple macos (<26.5)
- apple tvos (<26.5)
- apple watchos (<26.5)
have more...

TTPs:
Tactics: 4
Technics: 10

IOCs:
Domain: 43
File: 23
Url: 7
IP: 4
Email: 5
Hash: 6

Soft:
ophimcms, macOS, KKPhim, Laravel, Android, CryptoJS, Polyfill

Wallets:
bitkeep_wallet, tonkeeper

Algorithms:
pbkdf2, sha256, aes, base64

Functions:
jquery_beauty

Languages:
php, javascript

Platforms:
arm, apple