"The injected code runs two operations against a site's visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware," Socket security researcher Kush Pandya said.
Socket's discovery: 13 trojanized Packagist theme packages
Researchers at Socket identified 13 malicious Composer theme packages on Packagist that were trojanized to inject JavaScript into Vietnamese movie and comic streaming sites using those libraries. Socket says the packages span five vendor namespaces and include:
- vsmov: theme-dy, theme-rrdyw, theme-motchill, theme-vsmov
- vsphim: theme-heovl, theme-thempho
- haiau009: kkphim-legend, kkphim-motchill
- chilltvcms: theme-legend
- ophimcms: theme-dy, theme-motchill, theme-pcc, theme-rrdyw
Socket traces the activity to a campaign first documented in March 2026, during which similar OphimCMS-themed packages redirected visitors, exfiltrated URLs, injected ads, and served a second-stage payload hosted on Funnull infrastructure.
The iOS attack chain: CVE-2025-31277 and CVE-2025-43529
On iPhones the injected JavaScript inserts a hidden iframe that probes the device's iOS version and loads an OS-specific exploit. Socket describes the chain as weaponizing two WebKit vulnerabilities, CVE-2025-31277 (patched in version 18.6) and CVE-2025-43529 (patched in versions 18.7.3 and 26.2), in a manner analogous to the DarkSword exploit kit.
According to Socket, the payload then pivots out of the WebContent sandbox into the GPU process, and follows with a kernel escape via the AppleM2ScalerCSCDriver IOKit user client to obtain read and write privileges. Socket reports that Apple addressed the kernel escape flaw in iOS and macOS 26.1.
When successful, the final payload uses kernel read access to collect keychain databases, Wi‑Fi passwords, the SMS database, the address book, Photos, browser cookies, call history, location history, and account databases. Those items are encrypted with AES and uploaded over HTTPS POST /upload to a rotating pool of command-and-control domains, Socket said. The worker also beacons exploitation progress to cloudfareintcdn[.]com/wd-status.html.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageRedeployment on August 12, 2026 and a new focus on wallet seeds
Socket observed the adversary redeploy the full iOS chain around August 12, 2026, with a new payload addition: an iOS Keychain cryptocurrency wallet seed and mnemonic stealer. The redeployment mainly targeted devices running iOS versions 18.4 through 18.6.x, a range Socket notes includes iPhone XS through iPhone 16.
The malware queries the password store for wallet material from a named set of wallet apps: Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX — extending the campaign from device‑level espionage to direct financial theft.
Infrastructure and attribution: Funnull hosting and commit metadata
Socket links the exploit hosts to infrastructure provided by Funnull. The report notes Funnull was sanctioned by the U.S. last May for facilitating romance baiting scams that led to over $200 million in cryptocurrency losses. Socket also reports that commit metadata timestamps point toward a Vietnamese‑operated group, though the company says attribution is not definitive.
Separately, Socket found that the same five vendor namespaces published additional theme packages that carried no active payload at the time of analysis but were configured so malicious code could be activated via "Custom JS" fields rendered into every page on affected websites.
What this means for OphimCMS and KKPhim operators, iPhone users, and security teams
- OphimCMS and KKPhim site operators: Socket advises checking installed Composer packages for the listed theme names, removing any that match, rotating credentials, and auditing shipped jQuery and theme scripts for indicators of compromise.
- iPhone users running iOS 18.4–18.6.x: Visitors to sites that installed one of these trojanized themes can have keychains, wallet seeds, Wi‑Fi passwords, SMS, Photos, contacts, cookies, location history, and account databases collected and exfiltrated simply by loading a page in mobile Safari, Socket warned.
- Security and incident-response teams: The campaign demonstrates a supply‑chain vector — Composer themes on Packagist — delivering both ad‑fraud redirects and a high‑impact exploit chain; teams should prioritize package audits and monitoring for unusual outbound POST /upload traffic and beacons to domains such as cloudfareintcdn[.]com.
Socket's findings tie a web supply‑chain compromise to an iOS exploit chain that culminates in broad data theft and, after August 12, 2026, explicit targeting of cryptocurrency wallet seeds. Site operators are victims as well as conduits; Socket concludes that many operators "shipped the trojanized theme unknowingly and served the payload to their own users." The combination of Packagist distribution, Funnull‑hosted exploits, and named wallet targets creates a compact but dangerous playbook for adversaries seeking both ad revenue and direct cryptocurrency theft.
