Cybersecurity researchers discovered 13 malicious Composer theme packages on Packagist, the PHP package repository, designed to target unpatched iOS devices. The packages inject malicious JavaScript into Vietnamese movie and comic streaming sites that install the libraries. The injected code performs two main operations against site visitors: mobile ad-fraud and gambling redirects, while also deploying spyware targeting unpatched iPhones. The ultimate goal appears to be stealing cryptocurrency wallet seeds from compromised iOS devices. This represents a supply chain attack leveraging trusted package repositories to reach end users through compromised websites.
13 malicious Composer/Packagist theme packages spanning five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) were found injecting JavaScript into Vietnamese movie and comic streaming sites. The injected JS performs two operations: (1) a mobile ad-fraud and gambling-redirect chain targeting all mobile visitors, and (2) a WebKit-to-kernel exploit chain targeting unpatched iPhones. The iOS attack chain inserts a hidden iframe that detects the iOS version and loads an OS-specific exploit, weaponizing CVE-2025-31277 and CVE-2025-43529 (WebKit vulnerabilities), similar to the DarkSword exploit kit. The payload escapes the WebContent sandbox into the GPU process, then reaches the kernel via the AppleM2ScalerCSCDriver IOKit user client to gain read/write privileges. On success, the final payload collects keychain databases, Wi-Fi passwords, SMS database, address book, Photos, browser cookies, call history, location history, and account databases, encrypts them with AES, and uploads them over HTTPS POST /upload to a rotating pool of C2 domains. Exploitation progress is beaconed to cloudfareintcdn[.]com/wd-status.html. Around August 12, 2026, the threat actors redeployed the chain with a new payload adding an iOS Keychain cryptocurrency wallet seed and mnemonic stealer targeting Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX. The campaign was first documented in March 2026 using six malicious Packagist packages. Exploit infrastructure is hosted by Funnull. The campaign is assessed to be operated by a Vietnamese group based on commit metadata timestamps.
1. Site operators using OphimCMS or KKPhim should immediately check if any of the 13 identified malicious packages are installed and remove them if found. 2. Rotate all credentials associated with affected sites. 3. Audit all shipped jQuery and theme scripts for indicators of compromise (see https://socket.dev/blog/packagist-themes-ios-spyware#Indicators-of-Compromise-(IOCs)). 4. iPhone users should update iOS to version 18.7.3, 26.2 or later to patch CVE-2025-31277 and CVE-2025-43529, and update to iOS/macOS 26.1 or later to patch the kernel escape vulnerability. 5. Monitor for outbound connections to cloudfareintcdn[.]com and Funnull-hosted infrastructure. 6. Monitor for suspicious HTTPS POST /upload requests to unknown C2 domains. 7. Check for hidden iframe elements injected into web pages. 8. Review Packagist package integrity and verify all composer dependencies against known-good versions. 9. Be aware that additional packages from the same five vendor namespaces may contain dormant malicious code activatable via 'Custom JS' fields.
cloudfareintcdn[.]com/wd-status.html (C2 beacon endpoint), Funnull-hosted infrastructure (rotating C2 domains for HTTPS POST /upload), Hidden iframe injection in page HTML, HTTPS POST /upload requests to rotating C2 pool, Malicious Packagist packages: vsmov/theme-dy, vsmov/theme-rrdyw, vsmov/theme-motchill, vsmov/theme-vsmov, vsphim/theme-heovl, vsphim/theme-thempho, haiau009/kkphim-legend, haiau009/kkphim-motchill, chilltvcms/theme-legend, ophimcms/theme-dy, ophimcms/theme-motchill, ophimcms/theme-pcc, ophimcms/theme-rrdyw, AES-encrypted data exfiltration over HTTPS, JavaScript injection targeting mobile Safari
