In a sophisticated cyberattack, hackers are targeting iPhone users by embedding malicious code into website themes, transforming ordinary visits into opportunities for cryptocurrency theft and spyware infiltration. This alarming trend, identified by Socket.dev and reported to Cyber Security News, exploits themes used on Vietnamese streaming sites, catching users unawares.
Method of Attack
The attack vector involves compromised themes installed through Composer, a tool widely used for adding components to websites. Once these themes are adopted by site operators, every visitor to the site is exposed to potential risks. While mobile users may be redirected to gambling sites, iPhone users face more severe threats, as the malicious code appears on seemingly legitimate streaming platforms.
Socket.dev’s research uncovered 13 compromised theme packages, revealing how easily a front-end theme can become a silent attack vector. The threat extends to site operators, who may unknowingly expose user data and wallet recovery information, echoing past npm package compromises.
Technical Exploits and Vulnerabilities
The altered themes contain JavaScript loaders that assess the visitor’s device and referral source, bypassing desktop browsers and automated scanners. For mobile users, the attack injects ads and redirects browsers to gambling sites. However, iPhone users face a more targeted approach, where the script exploits known WebKit vulnerabilities to gain deeper device access.
Apple has addressed these vulnerabilities, emphasizing the importance of updating to the latest iOS versions. Devices on outdated software remain vulnerable, as the attack chain targets specific iOS versions.
Impact on iPhone Users
Once access is established, the spyware collects sensitive data, including keychain contents, Wi-Fi passwords, and cryptocurrency wallet seed phrases. This data is encrypted and sent to a rotating set of command-and-control servers, making detection challenging. The attack’s focus on wallet seed phrases poses a significant financial risk, as these codes can grant attackers control over cryptocurrency funds.
The attackers update filenames and components frequently, complicating detection and takedown efforts. This tactic is reminiscent of other package ecosystem threats, where seemingly benign updates hide malicious intentions.
Protective Measures and Recommendations
Website operators using affected content management systems should scrutinize themes, update front-end scripts, and monitor network activity for signs of compromise. Developers are advised to review Composer dependencies rigorously. Security teams should block network indicators and prioritize iPhone updates to mitigate risks.
This campaign serves as a stark reminder of the dangers posed by software supply chain attacks, affecting not only developers but also end-users visiting compromised sites. Staying vigilant and maintaining up-to-date software are crucial steps in protecting against such threats.
