Crypto theft in 2026 is increasingly starting before users even open a wallet. Attackers are compromising software packages and mobile applications to steal seed phrases, private keys and credentials directly from developers and iPhone users.
Recent campaigns show why keeping cryptocurrency on a secure blockchain does not protect funds if the recovery phrase itself is exposed.
Security researchers recently identified 13 malicious Packagist packages distributed across five developer namespaces.
The compromised themes injected JavaScript capable of identifying iPhone visitors and delivering an exploit chain targeting unpatched devices. The attack used WebKit vulnerabilities CVE-2025-31277 and CVE-2025-43529, which Apple had already patched in newer iOS releases.
Once successful, the chain escaped the browser sandbox and ultimately obtained deeper system access capable of supporting spyware and cryptocurrency-wallet theft. This demonstrates why delayed software updates can turn an ordinary website visit into a crypto-security problem.
Supply-chain attacks also target people building crypto applications. In July, attackers compromised version 1.20.21 of Injective Labs’ @injectivelabs/sdk-ts npm package. The legitimate software development kit receives roughly 50,000 weekly downloads and is used in wallets, trading tools and DeFi applications.
The malicious release attempted to steal wallet private keys and mnemonic recovery phrases.
Another compromised npm release, jscrambler@8.14.0, installed a Rust-based infostealer targeting Windows, Linux and macOS.
Researchers found it searching for MetaMask, Phantom and Exodus wallet data and seed phrases alongside cloud credentials, browser passwords and password-manager information.
Kaspersky reported finding more than two dozen phishing applications mimicking popular crypto wallets in Apple’s App Store.
Some applications redirected users toward sideloaded wallet clones. Those fake wallets could display prompts requesting recovery phrases and transmit entered words directly to attackers.
SparkKitty has taken another approach by searching phone photo libraries for screenshots containing recovery phrases.
A seed phrase can recreate a wallet without needing the original phone, hardware wallet or password. Once attackers obtain it, moving funds usually requires no additional approval from the victim.
Users should therefore never store recovery phrases in screenshots, cloud photo libraries or ordinary notes.
Why this MattersCrypto security threats increasingly target software dependencies, mobile apps and recovery phrases rather than blockchains themselves. Keeping devices updated, verifying wallet apps and protecting seed phrases can therefore be just as important as choosing a secure wallet.
The latest attacks show that crypto theft can begin far outside the wallet itself. Malicious packages, fake applications and compromised dependencies can expose recovery phrases before users realize anything is wrong.
For users, the strongest protection is disciplined seed-phrase storage and careful software hygiene. For developers, dependency monitoring and supply-chain security are becoming essential parts of protecting downstream crypto users.
Also Read: CYBERLEEK Wallets Move $350K as GTA VI Leaks Drive Token Trading
1. How are malicious crypto packages targeting iPhone users?
Attackers can inject harmful JavaScript into compromised software packages and use it to identify vulnerable iPhone users. Exploit chains can then target unpatched devices and potentially expose wallet-related data.
2. What happened with the Injective Labs npm package?
Attackers compromised version 1.20.21 of @injectivelabs/sdk-ts, a package with roughly 50,000 weekly downloads. The malicious release attempted to steal private keys and mnemonic recovery phrases.
3. How are fake iPhone wallet apps stealing crypto?
Some malicious apps imitate legitimate crypto wallets and redirect users to fake or sideloaded versions. These apps can request recovery phrases and transmit the entered words directly to attackers.
4. Why are seed phrases such an important target?
A seed phrase can recreate a crypto wallet without requiring the original device or password. Once attackers obtain it, they may be able to transfer funds without further approval from the wallet owner.
5. How can users protect crypto recovery phrases?
Users should avoid storing seed phrases in screenshots, cloud photo libraries or ordinary notes. Keeping devices updated, verifying wallet publishers and avoiding suspicious apps or configuration profiles can also reduce exposure.
Join our WhatsApp Channel to get the latest news, exclusives and videos on WhatsApp
_____________
Disclaimer: Analytics Insight does not provide financial advice or guidance on cryptocurrencies and stocks. Also note that the cryptocurrencies mentioned/listed on the website could potentially be risky, i.e. designed to induce you to invest financial resources that may be lost forever and not be recoverable once investments are made. This article is provided for informational purposes and does not constitute investment advice. You are responsible for conducting your own research (DYOR) before making any investments. Read more about the financial risks involved here.