13 malicious Composer theme packages on Packagist that turn Vietnamese movie and comic streaming websites into delivery points for iPhone spyware, gambling redirects, ad fraud, and cryptocurrency-wallet theft.
Once an operator installs one of the trojanized themes through Composer, the bundled front-end JavaScript is served to every visitor.
Mobile users are selectively targeted, while iPhone visitors on outdated iOS versions can be redirected into a WebKit-to-kernel exploit chain capable of extracting highly sensitive device data.
The confirmed malicious packages are published under the vsmov, vsphim, haiau009, chilltvcms, and ophimcms namespaces.
The set includes vsmov/theme-dy, vsmov/theme-rrdyw, vsphim/theme-heovl, haiau009/kkphim-legend, chilltvcms/theme-legend, and multiple ophimcms variants.
The campaign expands on Socket’s earlier investigation into six malicious ophimcms themes.
Researchers found that the operators forked legitimate Vietnamese streaming CMS projects, retained much of the original scaffolding, and injected malicious loaders into JavaScript assets such as jQuery, player scripts, and theme-specific files.
This makes compromised sites unwitting distribution infrastructure rather than the attackers’ intended endpoint.
The injected code applies platform and referrer checks to reduce detection. Desktop visitors, bots, and users who arrive directly may not receive the payload, while mobile visitors are routed into either a gambling and advertising chain or an iOS exploitation flow.
The iOS branch begins with obfuscated JavaScript that decodes and loads a second-stage script from infrastructure linked to FUNNULL.
The loader ultimately injects a hidden iframe that fingerprints the iPhone’s operating-system version and downloads a matching WebKit exploit.
Socket Researchers said that, the packages, distributed across five vendor namespaces, target sites built with the Laravel-based OphimCMS and KKPhim platforms.
The chain weaponizes CVE-2025-31277 and CVE-2025-43529, two publicly known WebKit vulnerabilities affecting older iOS releases.
CVE-2025-43529 is a use-after-free vulnerability that can enable memory corruption when a victim processes malicious web content.
Apple fixed it in iOS 18.7.3, iOS 26.2, Safari 26.2, and corresponding Apple operating-system releases.
Both WebKit vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities catalog, which tracks vulnerabilities with confirmed exploitation in the wild and is intended to guide remediation prioritization.
After gaining code execution in the WebContent renderer, the exploit chain pivots through the GPU process and reaches the kernel via Apple’s AppleM2ScalerCSCDriver IOKit interface.
Socket said Apple confirmed that the kernel-escape component had already been addressed in iOS and macOS 26.1 before the company reported the campaign.
The final spyware payload can collect keychain databases, Wi-Fi credentials, SMS messages, contacts, photographs, browser cookies, call history, location history, account databases, notes, calendars, and health-related data.
The malware encrypts stolen information with AES and sends it to rotating command-and-control infrastructure using HTTPS POST requests.
More concerningly, a redeployed payload observed in August added keychain routines designed to retrieve crypto-wallet seed phrases and mnemonic material from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX.
The change shifts the operation from broad surveillance toward direct financial theft.
Researchers said the active exploit logic targets iPhone XS through iPhone 16 devices running iOS 18.4 through 18.6.x.
The payload does not include offset tables for iOS 18.7 or iOS 26, suggesting operators are focusing on users who have not applied Apple’s updates.
The same packages also deliver mobile ad-fraud and gambling traffic. A malicious banner shown to iPhone and Android users redirects through IP-based hosts and randomized .vip landing pages, using campaign identifiers such as vip344.
vsphim/theme-heovl@1.0.0 as known malware, identifying the trojanized front-end assets and the FUNNULL-hosted iOS WebKit-to-kernel chain they deliver (Source : Socket).Socket linked the exploit hosting to FUNNULL-associated infrastructure, while cautioning that shared infrastructure does not establish that all tenants are operated by the same threat actor.
The company noted that the Packagist operators appear Vietnamese-operated based on repository metadata and the projects they forked, whereas the exploit kit may represent a commodity or brokered capability.
Website operators using OphimCMS or KKPhim should immediately audit Composer dependencies and remove packages from the five identified namespaces.
They should also rotate credentials handled by affected servers, inspect front-end assets for appended script loaders, and review administrator-controlled “Custom JS” fields that may execute unescaped code.
iPhone users should update to at least iOS 18.7.3 on the iOS 18 branch or iOS 26.2 or later. Apple’s fixes close the known WebKit stages used by this campaign, while the reported kernel component was addressed earlier in iOS 26.1.
The incident underscores a critical software-supply-chain lesson: Composer themes and bundled browser assets are executable code in practice.
A dependency compromise can expose every visitor to a website not only the server that installed it.
| # | Packagist packages |
|---|---|
| 1 | vsmov/theme-dy |
| 2 | vsmov/theme-rrdyw |
| 3 | vsmov/theme-motchill |
| 4 | vsmov/theme-vsmov |
| 5 | vsphim/theme-heovl |
| 6 | vsphim/theme-thempho |
| 7 | haiau009/kkphim-legend |
| 8 | haiau009/kkphim-motchill |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…