Security Independently confirmed 2 publishers 2 min read Published Sep 1, 2026, 10:26 AM PDT Updated Sep 2, 2026, 1:48 PM PDT

Thirteen Packagist theme packages hand site visitors a WebKit-to-kernel iOS chain

Socket says trojanized OphimCMS and KKPhim themes chain two WebKit bugs to an IOKit kernel escape on visitors' iPhones, turning a Composer dependency problem into wallet seed theft from people who only loaded a page.

The Watch · Security desk

Send a correction

What happened

Socket counted 13 malicious Composer theme packages on Packagist, spread across five vendor namespaces, injecting JavaScript into the Vietnamese movie and comic streaming sites that installed them.
On iPhones the injected script loads a Funnull-hosted chain against two WebKit bugs, escapes the WebContent sandbox into the GPU process, then takes kernel read and write through an IOKit user client.
Around August 12, 2026 the operators redeployed the entire iOS chain at devices running 18.4 through 18.6.x, adding a stealer for Keychain cryptocurrency wallet seeds and mnemonic phrases.
The final payload AES-encrypts keychain, SMS, Photos, contacts, cookie and location data and POSTs it to a rotating pool of command and control domains, beaconing progress to cloudfareintcdn[.]com.

Why it matters

Who's exposed exposure The asset in reach is the visitor's phone, so an operator whose server was never touched has still delivered keychain and wallet theft to its own audience.
What it limits constraint Any answer of the form "we are patched" needs a version number attached, because no baseline earlier than 18.7.3 or 26.2 closes every leg of this chain.
Who has to decide decision Dependency review has to cover what a package renders into a browser, which is a different exercise from pinning a lockfile and scanning server-side code.
What it sets up precedent Seven more packages from the same five namespaces since March makes per-package takedown a treadmill and pushes the registry response toward banning the publishers.

Next story · Product · 3d ago

Apple's new Switch to Safari page gives Mac users more than 10 reasons to leave Chrome

Confirmed3 publishers

The code path shifts the victim partway through: Composer resolves the theme on the server, the theme ships jQuery and page scripts, and those scripts then execute in the browser of everyone who visits. The iOS leg opens with a hidden iframe that reads the OS version and serves the matching build of the exploit ^[13], which is how one payload covers a spread of devices without burning itself on a patched one. Socket's researcher Kush Pandya describes two parallel operations in the injected code: the ad-fraud and gambling redirect for all mobile visitors, and the exploit chain for iPhones ^[2].

The patch versions here matter as much as the CVE numbers. Socket reports CVE-2025-31277 closed in iOS 18.6 and CVE-2025-43529 closed in 18.7.3 and 26.2 ^[5]. The August 12, 2026 redeployment aimed at 18.4 through 18.6.x ^[7]. So a phone that took the 18.6 update has the first bug shut and still sits below the 18.7.3 line for the second ^[18]. The kernel escape through the AppleM2ScalerCSCDriver IOKit user client is, in the source's hedged phrasing, addressed in iOS and macOS 26.1 ^[21], and 26.1 predates 26.2, which means an estate standardised on 26.1 has the kernel leg closed and one WebKit leg open ^[19].

Socket also found further themes from the same five namespaces carrying no live payload at analysis time, configured so code could be switched on through Custom JS fields that render into every page ^[16]. That amounts to staged capability rather than a finished attack, and pulling the thirteen named packages addresses only that slice of it. Socket's advice to OphimCMS and KKPhim operators runs to checking installs, removing what is found, rotating credentials, and auditing the jQuery and theme scripts they are shipping ^[12].

Attribution is thin and Socket says as much: a Vietnamese-operated group, inferred from commit metadata timestamps ^[20]. The infrastructure link carries more weight. The exploit hosts run on Funnull, sanctioned by the United States last May over romance baiting scams tied to more than $200 million in cryptocurrency losses ^[9]. The August payload reads the same way, querying the keychain for Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet and OKX material ^[8].

Per Socket, a streaming site with an audience on older iPhones, anything from an iPhone XS to an iPhone 16 left on 18.6.x, is a better delivery surface than a phishing run, because the visitor agreed to nothing beyond loading a page in mobile Safari ^[10].

What to watch

Whether Packagist acts against the five vendor namespaces rather than the thirteen named packages, and whether the dormant themes get payloads.
Whether any second researcher corroborates the Vietnamese-operator attribution beyond commit metadata timestamps.
Whether the operators start targeting 18.7 or 26.x, which would mean a new WebKit bug rather than another redeploy of the same chain.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence54
Adoption32
Hype gap+12
Incentives68
Confidence52

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Researchers identified 13 malicious Composer theme packages on Packagist designed to inject JavaScript into Vietnamese movie and comic streaming sites that install them and initiate deployment of spyware aimed at unpatched iOS devices.
Reported Supported Source: SocketView cited source
[2]
Socket researcher Kush Pandya said the injected code runs two operations against a site's visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware.
Reported Supported Source: Kush Pandya, SocketView cited source
[3]
The packages span five vendor namespaces: vsmov (theme-dy, theme-rrdyw, theme-motchill, theme-vsmov), vsphim (theme-heovl, theme-thempho), haiau009 (kkphim-legend, kkphim-motchill), chilltvcms (theme-legend), and ophimcms (theme-dy, theme-motchill, theme-pcc, theme-rrdyw).
Reported SupportedView cited source
[4]
The activity is assessed as part of a campaign Socket first documented in March 2026, which used six malicious Packagist packages posing as OphimCMS themes to redirect visitors, exfiltrate URLs, inject ads and serve a Funnull-hosted second stage.
Reported Supported Source: SocketView cited source
[5]
The chain weaponises two WebKit vulnerabilities, CVE-2025-31277 (patched in version 18.6) and CVE-2025-43529 (patched in versions 18.7.3 and 26.2), in a manner analogous to the DarkSword exploit kit.
Reported SupportedView cited source
[6]
The payload pivots out of the WebContent sandbox into the GPU process, then a second stage reaches the kernel through the AppleM2ScalerCSCDriver IOKit user client and obtains read and write privileges.
Reported SupportedView cited source
[7]
The threat actors redeployed the whole iOS chain around August 12, 2026, mainly targeting iOS devices running versions 18.4 through 18.6.x, with a new payload that adds an iOS Keychain cryptocurrency wallet seed and mnemonic stealer.
Reported SupportedView cited source
[8]
The malware queries the password store for wallet material from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet and OKX.
Reported SupportedView cited source
[9]
The iOS exploit hosts run on infrastructure provided by Funnull, an entity sanctioned by the United States last May for facilitating romance baiting scams that led to over $200 million in cryptocurrency losses.
Reported SupportedView cited source
[10]
Socket said a visitor to a site that installed one of these themes, on an iPhone not updated past iOS 18.6.x (iPhone XS through iPhone 16), can have keychain, Wi-Fi passwords, SMS, Photos, contacts, cookies, location history, account databases and cryptocurrency wallet seeds collected and exfiltrated by loading a page in mobile Safari.
Reported Supported Source: SocketView cited source
[11]
Socket said every mobile visitor is also subject to the gambling-redirect and ad-injection chain, and that site operators are victims too because they shipped the trojanized theme unknowingly and served the payload to their own users.
Reported Supported Source: SocketView cited source
[12]
Socket advises site operators using OphimCMS or KKPhim to check whether they installed any of the named packages, remove them if found, rotate credentials, and audit shipped jQuery and theme scripts.
Reported Supported Source: SocketView cited source
[13]
The iOS attack chain inserts a hidden iframe that determines the iOS version and loads an operating-system-specific version of the exploit.
Reported SupportedView cited source
[14]
On success the final payload uses the kernel read to collect keychain databases, Wi-Fi passwords, the SMS database, the address book, Photos, browser cookies, call history, location history and account databases, encrypts them with AES, and uploads them over HTTPS POST /upload to a rotating pool of command and control domains.
Reported Supported Source: Kush Pandya, SocketView cited source
[15]
The worker beacons exploitation progress to cloudfareintcdn[.]com/wd-status.html.
Reported SupportedView cited source
[16]
Socket said the same five vendor namespaces have published additional theme packages carrying no active payload at the time of analysis, configured so the malicious code could be activated via Custom JS fields rendered into every page.
Reported Supported Source: SocketView cited source
[17]
The same five namespaces have gone from six malicious packages documented in March 2026 to thirteen, seven more package removals for the registry to chase.
Derived Supported
[18]
A device updated to 18.6 has CVE-2025-31277 closed but remains below the 18.7.3 patch level for CVE-2025-43529, which matches the August redeployment targeting band ending at 18.6.x.
Derived Supported
[19]
Version 26.1 closes the kernel escape but predates the 26.2 fix for CVE-2025-43529, so 26.1 leaves one WebKit leg of the chain open; full closure requires 18.7.3 or 26.2.
Derived Supported
[20]
It is not clear who is behind the campaign, although it is believed to be the work of a Vietnamese-operated group based on commit metadata timestamps.
Reported InsufficientView cited source
[21]
Apple is said to have addressed the kernel escape flaw in iOS and macOS 26.1.
Reported InsufficientView cited source

Sources

2 independent publishers whose own reporting we read for this story.

scworld.com
1 article · September 2, 2026
Malicious Composer themes deliver spyware to unpatched iOS devices
thehackernews.com
1 article · September 1, 2026
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

For anyone maintaining a PHP site, the sharp end of this reporting is not the iPhone exploit — it is that a theme package's payload runs in your visitors' browsers, where dependency review rarely looks. The Hacker News gives builders the only actionable inventory: five namespaces, thirteen names, plus sibling packages sitting inert with Custom JS fields wired into every page, waiting to be switched on. SC World's brief tells developers a problem exists but names nothing they could grep for.

Operator

Both outlets converge on the same four moves — look for the packages, remove them, rotate credentials, audit shipped jQuery and theme scripts — and both leave the harder operational question open: nobody says whether Packagist has pulled anything, so removal is on you. The patch story is where our coverage rewards close reading. Only The Hacker News prints the version numbers, and stacked together they say a fleet on 18.6 sits precisely in the August targeting band, while a device on 26.1 has the kernel escape closed and one WebKit bug still open until 26.2.

Investor

There is little here to price. The only figures in the whole story are thirteen packages, seven wallet brands and the $200 million in romance-baiting losses that got Funnull sanctioned — no victim count, no theft total, no install numbers, no named public company. The investor-relevant thread is structural rather than quantified: sanctioned infrastructure is still serving exploits, and a package registry is again the delivery layer, this time reaching end users who never chose the dependency.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence54: 0100
Specific to the byte, single-sourced to the vendor
The technical detail is unusually concrete — two CVE numbers with patch levels, the AppleM2ScalerCSCDriver user client, the typosquatted beacon at cloudfareintcdn[.]com, thirteen package names under five namespaces. All of it originates with one security vendor, reaches us through The Hacker News, and is then condensed by SC World from that same telling. No Apple advisory, no registry statement, no third party reproducing the chain. Two of the load points are hedged in the original wording: Apple 'is said to have' shipped the kernel fix, and attribution rests on commit timestamps.
Adoption32: 0100
Demonstrably live, blast radius unmeasured
The campaign is clearly operational and iterating: six packages in March became thirteen, the whole iOS chain was rebuilt around 12 August with a wallet-seed stealer bolted on, and more packages sit staged with the switch not yet thrown. What nobody supplies is scale. There are no download counts, no tally of streaming sites that shipped a trojanized theme, no confirmed victim, and no word on whether Packagist has taken a single package down. Real, in other words, and unquantified.
Hype gap+12: −100 understated0 aligned+100 overstated
Vendor framing carried straight through
Neither outlet reaches for drama beyond what Socket wrote, and the technical claims are far too specific to be padding. The overstatement is quieter: the most alarming sentence in the story — that loading a page in mobile Safari is enough to lose your keychain and your wallet seeds — is the vendor's own summary, published without exploit reliability figures, without a confirmed victim, and without anyone outside Socket having run the chain. SC World then repeats the conclusion while shedding the version numbers that would let a reader judge their own exposure.
Incentives68: 0100
A registry-scanning vendor's shop window
Socket's business is spotting exactly this — malicious packages in public registries — and a thirteen-package find with an iPhone exploit chain and stolen crypto seeds is the best advertisement that business could ask for. That does not make it wrong; it does mean the only party with the artefacts is also the party that benefits from their severity, and neither outlet in our coverage tested a claim independently. On the other side of the ledger, the attackers' own incentives are now explicit: the August payload reaches past surveillance data into seven wallets' seed phrases.
Confidence52: 0100
Internally coherent, externally unchecked
The account holds together: the targeting band, the patch levels and the August redeployment line up in a way that would be hard to invent by accident, and that internal consistency is the main reason to take it seriously. But confidence stalls where the sourcing does. One vendor, one originating outlet, one derivative brief, a hedged patch claim, an unresolved actor, and not a single figure describing how many sites or phones were actually touched.

Topics and entities

Topics

Sanctioned Attack Infrastructure
Crypto Wallet Credential Theft
Software Supply Chain Attacks
iOS exploit chains
Package Registry Abuse
Ad Fraud and Gambling Redirects