Security researchers at Socket have identified 13 malicious Composer/Packagist theme packages that silently exploit unpatched iPhones visiting Vietnamese movie and comic streaming sites built on OphimCMS and KKPhim. The packages — published under five vendor namespaces including ophimcms and vsmov — inject JavaScript into every page served by sites that install them. When a visitor loads one of those pages on an unpatched iPhone, the JavaScript launches a Funnull-hosted exploit chain that targets two WebKit vulnerabilities: CVE-2025-31277 (patched in iOS 18.6) and CVE-2025-43529 (patched in iOS 18.7.3 and iOS 26.2). The chain pivots from the WebContent sandbox into the GPU process, then uses an IOKit user-client bug in the AppleM2ScalerCSCDriver to reach the kernel and obtain full read/write access. Apple addressed the kernel escape vulnerability in iOS 26.1 and macOS 26.1. A new payload deployed around August 12, 2026 added a cryptocurrency wallet seed stealer that queries the iOS keychain for wallet material from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX.
On a successful compromise, the malware collects and AES-encrypts keychain databases, saved Wi-Fi passwords, the SMS database, address book contacts, Photos, browser cookies, call history, location history, and account databases, then exfiltrates the bundle over HTTPS to a rotating pool of command-and-control domains. Every mobile visitor — regardless of iOS version — is also subject to ad-injection and gambling redirect chains. The threat actors behind the campaign are believed to be a Vietnamese-operated group, based on commit metadata. Their infrastructure runs on Funnull, a CDN sanctioned by the United States in May 2026 for facilitating romance scams that caused over $200 million in cryptocurrency losses. Site operators are themselves victims: they installed the trojanized themes without knowing the packages contained malicious code.
How to check if you’re affected
Affected devices are iPhones running iOS 18.4 through 18.6.x (iPhone XS through iPhone 16) that have visited a Vietnamese streaming or comic site. If your iPhone runs iOS 18.7.3, iOS 26.1, or later, the WebKit and kernel vulnerabilities are patched — update immediately if you haven’t already. Site operators using OphimCMS or KKPhim should check whether any of the malicious packages are installed, remove them, rotate credentials, and audit JavaScript loaded on every page for unfamiliar scripts.
Sources
- The Hacker News — 13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
- Socket Security (researcher Kush Pandya)