CVE

CVE-2025-31277

View on NVD ↗

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption.

Exploitation IoCs 15

Domain cloudfareintcdn[.]com
Domain funnull-hosted
Package chilltvcms/theme-legend
Package haiau009/kkphim-legend
Package haiau009/kkphim-motchill
Package ophimcms/theme-dy
Package ophimcms/theme-motchill
Package ophimcms/theme-pcc
Package ophimcms/theme-rrdyw
Package vsmov/theme-dy
Package vsmov/theme-motchill
Package vsmov/theme-rrdyw
Package vsmov/theme-vsmov
Package vsphim/theme-heovl
Package vsphim/theme-thempho

MITRE ATT&CK TTPs 6

T1003
OS Credential Dumping
Credential Access
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1189
Drive-by Compromise
Initial Access
 T1204.002
Malicious File
Execution
 T1566
Phishing
Initial Access

Source Articles

13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
Security researchers have uncovered 13 malicious Packagist packages distributed under five vendor namespaces that target unpatched iOS devices through compromised Vietnamese movie and comic streaming sites. The packages inject JavaScript to conduct ad fraud and gambling redirects, while also deploying a WebKit-to-kernel exploit chain on iPhones to install spyware. The exploit chain leverages CVE-2025-31277 and CVE-2025-43529, ultimately achieving kernel-level access to steal sensitive data including keychain databases, Wi-Fi passwords, SMS, photos, and cryptocurrency wallet seeds from popular wallets like Trust Wallet and Phantom. The stolen data is encrypted with AES and exfiltrated to command and control domains, with exploitation progress beaconed to cloudfareintcdn[.]com.
hacker-news Sep 1, 2026