A compromised streaming page can take an unpatched iPhone to kernel access and steal secrets.

JavaScriptCore renderer corruption → GPU process → Apple driver race → kernel read/write.

Affects

Apple iPhone XS through iPhone 16 running vulnerable iOS 18 releases when Mobile Safari loads a site using one of 13 trojanized OphimCMS or KKPhim Packagist themes.

What it enables

Drive-by spyware execution with kernel memory access and bulk credential, message, photo, and cryptocurrency-wallet-secret exfiltration

An internet attacker gets a trojanized Packagist theme served by a streaming site.→↓Injected JavaScript fingerprints the device and loads an iOS-specific exploit through a hidden frame.→↓A JavaScriptCore vulnerability provides arbitrary read/write in the WebKit renderer.→↓Mach and IOSurface primitives pivot execution into the GPU process.→↓An XPC request through mediaplaybackd opens AppleM2ScalerCSCDriver, where a race yields kernel read/write.→↓The spyware reads and exfiltrates keychains, Wi-Fi credentials, messages, photos, cookies, account and location databases, and—in the August redeployment—wallet seed phrases.

Why this matters

The exploit chain reaches kernel read/write through renderer corruption and the GPU process; the spyware collects secrets from the handset.

Detail and 2 sources

Required access

Internet control of the injected theme payload or its exploit infrastructure; the victim only has to load an affected streaming page in Mobile Safari.

Affected versions

iOS 18.4 through 18.6.x on iPhone XS through iPhone 16; the recovered chain lacked offsets for iOS 18.7 and iOS 26

Proof of concept

Demonstrated by the researcher

The campaign began with an attacker-controlled Packagist theme served by a streaming site. The victim needed only to load the affected page in Mobile Safari.

JavaScriptCore supplied renderer read/write; Mach and IOSurface primitives then reached the GPU process and an Apple driver race supplied kernel read/write.

Collection included keychains, Wi-Fi credentials, messages, photos, cookies and account data. An August redeployment added wallet seed phrases.

Apple published updates, but the assessed boundary remains open on end-of-life hardware and the capability is not fully removed.

Evidence

Primary research reconstructs the live delivery, renderer, GPU, kernel, and collection stages from malicious artifactsResearch documents an August redeployment adding cryptocurrency-wallet seed theftApple published the relevant platform security updates

Sources

Research13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds | Socket ResearchAbout the security content of iOS 26.1 and iPadOS 26.1 - Apple Support

Copy link

Share this finding

Email Hacker News Reddit Mastodon Bluesky X LinkedIn Facebook Copy link