Malicious Composer Packages Target iOS Devices With Spyware on Vietnamese Streaming Sites

Security experts have uncovered 13 malicious Composer theme packages on Packagist that inject JavaScript into Vietnamese movie and comic streaming platforms, launching spyware attacks against unpatched iOS devices, according to a report published by Socket in September 2026. The trojanized libraries run two operations against site visitors: a mobile ad-fraud and gambling-redirect chain, and on iPhones, a WebKit-to-kernel exploit chain that installs spyware. The activity appears to be part of a campaign Socket first documented in March 2026 that used six malicious Packagist packages posing as OphimCMS themes.

The 13 packages span five vendor namespaces—vsmov, vsphim, haiau009, chilltvcms, and ophimcms—and carry names like theme-dy, theme-motchill, kkphim-legend, and theme-pcc. The attack chain weaponizes two WebKit vulnerabilities, CVE-2025-31277 (patched in version 18.6) and CVE-2025-43529 (patched in versions 18.7.3 and 26.2), in a manner similar to the DarkSword exploit kit. The iOS attack inserts a hidden iframe element that determines the iOS version and loads an operating system-specific version of the exploit. The payload pivots out of the WebContent sandbox into the GPU process, followed by a second stage that reaches the kernel through the AppleM2ScalerCSCDriver IOKit user client and ultimately gains read and write privileges. Apple addressed the kernel escape flaw in iOS and macOS 26.1, though the company didn't share a CVE identifier—it's suspected to be CVE-2025-43398, CVE-2025-43510, or CVE-2025-43520, all kernel-related bugs fixed late last year.

Socket security researcher Kush Pandya told The Hacker News that on success, the final payload uses kernel read privileges to collect keychain databases, Wi-Fi passwords, the SMS database, the address book, Photos, browser cookies, call history, location history, and account databases, encrypts them with AES, and uploads them over HTTPS POST to a rotating pool of command and control domains. The threat actors redeployed the entire iOS chain around August 12, 2026, mainly targeting iOS devices running versions 18.4 through 18.6.x with a new payload that adds an iOS Keychain cryptocurrency wallet seed and mnemonic stealer. The malware queries the password store for wallet material from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX, extending beyond device data collection to direct financial theft. Socket said the same five vendor namespaces have published additional theme packages that carry no active payload at the time of analysis, though they've been configured such that malicious code could be activated via "Custom JS" fields rendered into every page on the websites.

The attack targets visitors to sites that installed these themes, with Socket noting that a visitor on an iPhone that hasn't been updated past iOS 18.6.x (iPhone XS through iPhone 16) can have their keychain, Wi-Fi passwords, SMS, Photos, contacts, cookies, location history, account databases, and cryptocurrency wallet seeds collected and exfiltrated by loading a page in mobile Safari. Every mobile visitor is also subject to the gambling-redirect and ad-injection chain. The site operators themselves are victims, having shipped the trojanized theme unknowingly and served the payload to their own users. It's believed to be the work of a Vietnamese-operated group based on commit metadata timestamps, and the iOS exploit hosts run on infrastructure provided by Funnull, an entity sanctioned by the U.S. last May for facilitating romance baiting scams that led to over $200 million in cryptocurrency losses. To counter the threat, site operators using OphimCMS or KKPhim are advised to check if they've installed any of the aforementioned packages, remove them if found, rotate credentials, and audit shipped jQuery and theme scripts for indicators of compromise. The infrastructure overlap with sanctioned entities suggests attribution may become clearer as enforcement actions unfold, while the continuous retooling of exploits signals that patch adoption timelines remain a critical defensive variable for consumer device security.