Socket's Threat Research Team discovered 13 malicious Composer/Packagist theme packages across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject malicious JavaScript into Vietnamese movie and comic streaming sites. The injected code runs two operations: a mobile ad-fraud/gambling redirect chain, and on iPhones, a WebKit-to-kernel exploit chain (DarkSword-linked, using CVE-2025-31277 and CVE-2025-43529) that installs spyware. The spyware collects keychain data, Wi-Fi passwords, SMS, contacts, photos, browser cookies, location history, and cryptocurrency wallet seeds from seven wallet apps (Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, OKX). The campaign is attributed to Vietnamese-operated threat actors using FUNNULL infrastructure (sanctioned by OFAC). On 2026-08-12, the operators redeployed with fresh filenames and added crypto-wallet seed theft. The kernel escape was patched in iOS 26.1 and WebKit entry points in iOS 18.7.3/iOS 26.2; unpatched devices remain vulnerable.
union[.]macoms[.]la/jquery.min-3.6.8.js, cdn[.]data-2920[.]com, cdn[.]data-2919[.]com, www[.]cloudfareintcdn[.]com, yunray[.]ai, cdn1[.]ai, nqsaaskw[.]com, abfedgecanme[.]com, abfdns[.]com, galedns[.]com, 23[.]225[.]52[.]67:4466, 23[.]225[.]48[.]20:4466, im[.]ue8im[.]com, xl0ph4qz[.]vip:7740, cre-ads[.]com, www[.]0liwevrhxdc3s2xk00[.]com, www[.]39rwcybep-20pwozhvdrzzy[.]net, www[.]5wg3w278e3oamlohmcinrkh[.]live, www[.]dlosdekr1u18msmov51[.]net, www[.]ex0x40vmi8qyccxq[.]net, www[.]ioa7xqmhiz26fv5e[.]info, www[.]isbo31w1o7xk3fztvmgpbv[.]app, www[.]jhflt6l0dwminsl494836rb[.]org, www[.]kp2-3ur6pe4r8i2hj5[.]com, www[.]ljot1cem6jhzfu53yb9aj3h[.]app, www[.]ncalb1rzb2rq5-3zdx1[.]app, www[.]ov86ayb0fe4ep2b92-645o[.]com, www[.]qdh71-y6j7vxgw046v4cvgga[.]live, www[.]sx3cjniwo1bmtqs0vlj-va2f[.]app, www[.]sx8vuz4smtdol7pg[.]com, www[.]t9ffxu6zhf915fadjv1[.]app, www[.]vutjsf0sd9sdqt2rkzvgzv9a[.]org, www[.]w4iunvbdvjof39q-3[.]net, www[.]xtpj2bzxip6iq7n3bnz[.]info, www[.]zfu4n4kxgmx32hsqg[.]cc, 60b6771958cb7e553994ba6752f108575ba70e02d24affb51d8936a17eb0bf5e, d9530e8cd79ac7b3d02b04e05426653afca7075fcf7424eec4d59c6e95745933, 92c7d246d2c163c076f783dcc19f87f5b9b9ac301b106b87a7aaea9346ce0052, f2fdfddbc436acc24a654092f5205b2c5bd3208b126b2c2754ac63e7aea22298, 9d6b58886189c0e23f706c32d3d8dda97b0b6d927ece6de07270813f070295b5, de539a63cbe27bbd4a7db30fc796cd6dc5309c02ef5e60a3c5cf0835e5601283, clemenciajohn74@gmail[.]com, dev.cuongnguyen@gmail[.]com, nguyenhai.tran.009@gmail[.]com, xuxuthoi01@gmail[.]com, tuwibu2021@gmail[.]com, 9_X1<yW,DC>M=<;5, 22c75b2ee026dbbf7001cfdc2bb47855
