Cybersecurity researchers have identified a critical threat stemming from 13 malicious Composer theme packages hosted on **Packagist**. These packages are designed to inject JavaScript into Vietnamese movie and comic streaming sites that integrate them, subsequently deploying spyware aimed at unpatched iOS devices. **Kush Pandya**, a security researcher at **Socket**, explained, "The injected code runs two operations against a site's visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware." This activity is believed to be a continuation of a campaign first documented by **Socket** in March 2026. That earlier campaign utilized six malicious **Packagist** packages, masquerading as **OphimCMS** themes, to redirect visitors, exfiltrate URLs, inject ads, and serve second-stage payloads from **Funnull**-hosted infrastructure, leading victims to gambling and adult content sites. The complete list of malicious packages, spanning five vendor namespaces, includes: * **vsmov**: theme-dy, theme-rrdyw, theme-motchill, theme-vsmov * **vsphim**: theme-heovl, theme-thempho * **haiau009**: kkphim-legend, kkphim-motchill * **chilltvcms**: theme-legend * **ophimcms**: theme-dy, theme-motchill, theme-pcc, theme-rrdyw At a high level, the trojanized Composer themes inject JavaScript that initiates a mobile gambling and ad-fraud redirect. Crucially, on iPhones, it triggers a **Funnull**-hosted WebKit-to-kernel exploit chain, culminating in spyware installation and cryptocurrency-wallet theft. ### The iOS Attack Chain: A Multi-Stage Exploit  The iOS attack chain is sophisticated, designed to insert a hidden iframe element that identifies the iOS version and loads an operating system-specific exploit. It weaponizes two **WebKit** vulnerabilities: **CVE-2025-31277** (patched in iOS 18.6) and **CVE-2025-43529** (patched in iOS 18.7.3 and 26.2). This approach is reminiscent of the **DarkSword** exploit kit. The exploit then escapes the WebContent sandbox into the GPU process. A second stage achieves kernel access through the **AppleM2ScalerCSCDriver IOKit** user client, ultimately gaining read and write privileges. **Apple** reportedly addressed this kernel escape flaw in **iOS 26.1** and **macOS 26.1**. Pandya noted that **Apple** did not provide a **CVE** identifier for the kernel escape vulnerability but confirmed it was patched in **iOS 26.1** and **macOS 26.1** prior to **Socket**'s report. It is suspected to be one of **CVE-2025-43398**, **CVE-2025-43510**, or **CVE-2025-43520**, all kernel-related bugs fixed late last year. ### Data Exfiltration and Cryptocurrency Theft  Upon successful exploitation, the final payload leverages kernel read access to collect sensitive data, including keychain databases, Wi-Fi passwords, SMS databases, address books, photos, browser cookies, call history, location history, and account databases. This data is then encrypted with **AES** and uploaded via HTTPS POST to a rotating pool of command and control domains. The exploitation progress is beaconed to `cloudfareintcdn[.]com/wd-status.html`. The threat actors re-deployed the entire iOS chain around August 12, 2026, specifically targeting iOS devices running versions 18.4 through 18.6.x. The updated payload now includes an iOS Keychain cryptocurrency wallet seed and mnemonic stealer. This malware queries the password store for wallet material from **Bitget**, **BitKeep**, **Bitpie**, **Phantom**, **Tonkeeper**, **Trust Wallet**, and **OKX**, expanding its reach beyond device data collection to direct financial theft. **Socket** also observed that the same five vendor namespaces have published additional theme packages that, while lacking an active payload at the time of analysis, are configured to allow malicious code activation via "Custom JS" fields rendered on every page of affected websites. ### Attribution and Mitigation The identity of the group behind this campaign remains unconfirmed, but commit metadata timestamps suggest it is a Vietnamese-operated group. Notably, the iOS exploit hosts are run on infrastructure provided by **Funnull**, an entity sanctioned by the U.S. in May for facilitating romance baiting scams that resulted in over $200 million in cryptocurrency losses. **Socket** warns, "A visitor to a site that installed one of these themes, on an iPhone that has not been updated past iOS 18.6.x (iPhone XS through iPhone 16), can have their keychain, Wi-Fi passwords, SMS, Photos, contacts, cookies, location history, account databases, and cryptocurrency wallet seeds collected and exfiltrated by loading a page in mobile Safari." They add, "Every mobile visitor is also subject to the gambling-redirect and ad-injection chain. The site operators are victims too: they shipped the trojanized theme unknowingly and served the payload to their own users." To mitigate this threat, operators of sites using **OphimCMS** or **KKPhim** are strongly advised to: * Check for and remove any of the aforementioned malicious packages. * Rotate all credentials. * Audit shipped **jQuery** and theme scripts for **Indicators of Compromise (IOCs)**.