Malicious Composer Packages Target Vietnamese Streaming Sites with iPhone Spyware and Crypto Theft
Security researchers uncovered 13 trojanized Composer theme packages on Packagist, designed to compromise Vietnamese movie and comic streaming websites built on OphimCMS and KKPhim platforms. Once installed, these malicious themes inject JavaScript payloads into visitor browsers, selectively targeting mobile users particularly iPhone owners on outdated iOS versions to deliver spyware, gambling redirects, ad fraud, and cryptocurrency-wallet theft.
Attack Overview
The campaign, identified by Socket, expands on earlier findings involving six malicious ophimcms themes. Attackers forked legitimate Vietnamese CMS projects, retaining much of the original code while embedding malicious loaders in JavaScript assets like jQuery, player scripts, and theme files. This turns compromised sites into unwitting distribution points for the malware.
Targeting & Exploitation
The injected code performs platform and referrer checks to evade detection. While desktop users and direct visitors may bypass the payload, mobile users are funneled into one of two attack chains:
- Gambling & Ad Fraud – Redirects users to IP-based hosts and randomized .vip landing pages (e.g., vip344).
- iOS Exploitation – iPhone visitors on iOS 18.4–18.6.x (iPhone XS to iPhone 16) are targeted with a WebKit-to-kernel exploit chain, leveraging CVE-2025-31277 and CVE-2025-43529 two publicly known WebKit vulnerabilities added to CISA’s Known Exploited Vulnerabilities catalog.
The exploit chain begins with obfuscated JavaScript that decodes a second-stage payload from FUNNULL-linked infrastructure, ultimately injecting a hidden iframe to fingerprint the iOS version and deliver a matching WebKit exploit. After gaining renderer execution, the malware pivots through the GPU process and escalates to kernel access via Apple’s AppleM2ScalerCSCDriver IOKit interface.
Spyware Capabilities & Financial Theft
The final payload exfiltrates highly sensitive data, including:
- Keychain databases (passwords, credentials)
- Wi-Fi credentials, SMS messages, contacts, photos
- Browser cookies, call history, location data
- Crypto-wallet seed phrases (Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, OKX)
Stolen data is AES-encrypted and sent via HTTPS POST requests to rotating command-and-control (C2) servers. A redeployed payload in August shifted focus from broad surveillance to direct financial theft, specifically targeting cryptocurrency wallets.
Infrastructure & Attribution
The malicious packages were published under five Packagist namespaces:
- vsmov (theme-dy, theme-rrdyw, theme-motchill, theme-vsmov)
- vsphim (theme-heovl, theme-thempho)
- haiau009 (kkphim-legend, kkphim-motchill)
- chilltvcms (theme-legend)
- ophimcms (multiple variants)
Researchers linked the exploit hosting to FUNNULL infrastructure, though they noted that shared infrastructure does not confirm a single threat actor. The Packagist operators appear Vietnamese-based, given repository metadata and forked projects, while the exploit kit may be a commodity or brokered tool.
Mitigation & Impact
- Website operators using OphimCMS or KKPhim should audit Composer dependencies, remove the malicious packages, and rotate credentials handled by affected servers.
- iPhone users should update to iOS 18.7.3 (iOS 18 branch) or iOS 26.2+, as Apple’s patches close the WebKit vulnerabilities and the kernel component (fixed in iOS 26.1).
The incident highlights a critical software supply-chain risk: Composer themes and bundled browser assets can execute malicious code, exposing all visitors not just the server owner to compromise.
Source: https://gbhackers.com/iphone-vulnerabilities-exploited/
Packagist Conductors cybersecurity rating report: https://www.rankiteo.com/company/packagist
"id": "PAC1788243844",
"linkid": "packagist",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Mobile users (particularly '
'iPhone owners on iOS '
'18.4–18.6.x)',
'industry': 'Entertainment (Streaming)',
'location': 'Vietnam',
'name': 'OphimCMS-based websites',
'type': 'CMS Platform'},
{'customers_affected': 'Mobile users (particularly '
'iPhone owners on iOS '
'18.4–18.6.x)',
'industry': 'Entertainment (Streaming)',
'location': 'Vietnam',
'name': 'KKPhim-based websites',
'type': 'CMS Platform'}],
'attack_vector': 'Trojanized Composer packages (malicious themes)',
'data_breach': {'data_encryption': 'AES-encrypted exfiltration',
'data_exfiltration': True,
'personally_identifiable_information': ['Keychain databases',
'Wi-Fi credentials',
'SMS messages',
'Contacts',
'Photos',
'Browser cookies',
'Call history',
'Location data'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Credentials',
'Financial Data (Crypto-wallet '
'seed phrases)',
'Location Data',
'Communication Data (SMS, call '
'history)']},
'description': 'Security researchers uncovered 13 trojanized Composer theme '
'packages on Packagist, designed to compromise Vietnamese '
'movie and comic streaming websites built on OphimCMS and '
'KKPhim platforms. Once installed, these malicious themes '
'inject JavaScript payloads into visitor browsers, selectively '
'targeting mobile users (particularly iPhone owners on '
'outdated iOS versions) to deliver spyware, gambling '
'redirects, ad fraud, and cryptocurrency-wallet theft.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to '
'affected streaming sites',
'data_compromised': ['Keychain databases (passwords, credentials)',
'Wi-Fi credentials',
'SMS messages',
'Contacts',
'Photos',
'Browser cookies',
'Call history',
'Location data',
'Crypto-wallet seed phrases'],
'identity_theft_risk': 'High (stolen PII and credentials)',
'operational_impact': 'Compromised websites unknowingly '
'distributed malware to visitors',
'payment_information_risk': 'High (crypto-wallet seed phrases '
'stolen)',
'systems_affected': ['Vietnamese streaming websites (OphimCMS, '
'KKPhim)',
'Visitor browsers (iOS devices on iOS '
'18.4–18.6.x)']},
'initial_access_broker': {'backdoors_established': 'Malicious JavaScript '
'payloads in visitor '
'browsers',
'entry_point': 'Trojanized Composer packages '
'(malicious themes)',
'high_value_targets': ['iPhone users on iOS '
'18.4–18.6.x',
'Crypto-wallet users']},
'lessons_learned': 'Critical software supply-chain risk: Composer themes and '
'bundled browser assets can execute malicious code, '
'exposing all visitors to compromise.',
'motivation': ['Financial Theft',
'Data Exfiltration',
'Ad Fraud',
'Espionage'],
'post_incident_analysis': {'corrective_actions': ['Patch iOS vulnerabilities',
'Remove malicious Composer '
'packages',
'Rotate credentials',
'Audit third-party '
'dependencies'],
'root_causes': ['Supply-chain compromise via '
'trojanized Composer packages',
'Exploitation of publicly known '
'WebKit vulnerabilities '
'(CVE-2025-31277, '
'CVE-2025-43529)']},
'recommendations': ['Audit Composer dependencies for malicious packages',
'Remove trojanized themes and rotate credentials',
'Update iOS devices to patched versions (18.7.3 or 26.2+)',
'Monitor for unusual JavaScript injections in web assets'],
'references': [{'source': 'Socket Research'},
{'source': 'CISA Known Exploited Vulnerabilities Catalog'}],
'response': {'containment_measures': ['Removal of malicious Composer packages',
'Rotation of credentials handled by '
'affected servers'],
'remediation_measures': ['Update to patched iOS versions (18.7.3 '
'or 26.2+)',
'Audit Composer dependencies'],
'third_party_assistance': 'Security researchers (Socket)'},
'title': 'Malicious Composer Packages Target Vietnamese Streaming Sites with '
'iPhone Spyware and Crypto Theft',
'type': ['Supply Chain Attack',
'Malware Distribution',
'Spyware',
'Cryptocurrency Theft'],
'vulnerability_exploited': ['CVE-2025-31277', 'CVE-2025-43529']}