How to Secure an iPhone Crypto Wallet Against Malware and Web-Based Exploits

iPhone users running outdated iOS versions may face security risks after researchers linked poisoned website packages to an iOS exploit chain capable of accessing protected phone data and wallet secrets.

Socket, a cybersecurity platform, disclosed the campaign on after finding 13 malicious themes on Packagist. The packages infected websites rather than phones. As a result, avoiding fake wallet apps was not enough to protect a vulnerable iPhone from an affected Safari page.

What Are the Malicious Packagist Packages Designed to Do?

The packages posed as themes for OphimCMS and KKPhim, which support Vietnamese streaming sites. They appeared under five publishers: vsmov, vsphim, haiau009, chilltvcms, and ophimcms.

After a site operator installed a poisoned theme, hostile JavaScript appeared on its pages. Mobile visitors could receive gambling redirects or injected advertisements. The iPhone branch also checked the iOS version and loaded a matching exploit.

Socket’s investigation found two WebKit entry points. CVE-2025-31277 targeted iOS 18.4 and 18.5. CVE-2025-43529 covered iOS 18.6.

Later stages escaped WebKit’s protected process and reached the iOS kernel. That access allowed the payload to read data normally blocked from a website.