Researchers from Socket discovered 13 malicious Composer packages on Packagist disguised as themes for the Vietnamese CMS platforms OphimCMS and KKPhim. The packages inject JavaScript code into streaming video and comics sites that redirects mobile visitors to fraudulent resources and, on iPhone devices running unpatched versions of iOS (from 18.4 to 18.6.x), triggers a WebKit exploit chain that ends with spyware installation and theft of cryptocurrency wallets. The operators of the affected sites are victims as well: they unwittingly distribute the malicious payload to their own users.
Malicious packages and attack mechanism
According to the researchers, the trojanized packages are spread across five namespaces on Packagist:
- vsmov: theme-dy, theme-rrdyw, theme-motchill, theme-vsmov
- vsphim: theme-heovl, theme-thempho
- haiau009: kkphim-legend, kkphim-motchill
- chilltvcms: theme-legend
- ophimcms: theme-dy, theme-motchill, theme-pcc, theme-rrdyw
The campaign was first documented in March 2026, when six malicious packages impersonating OphimCMS themes were identified. They were used to redirect visitors, exfiltrate URLs, and inject advertisements. The current wave expands the toolkit to 13 packages and adds a full iOS exploitation chain.
The injected JavaScript performs two operations: for all mobile visitors, it redirects them to fraudulent gambling sites and injects ads; for iPhone users, it loads a hidden iframe element that determines the iOS version and selects the appropriate exploit.
Exploited WebKit vulnerabilities
The iOS attack chain leverages two WebKit vulnerabilities:
- CVE-2025-31277 — a WebKit memory corruption vulnerability fixed by Apple in iOS 18.6 and iPadOS 18.6 (released on 29 July 2025).
- CVE-2025-43529 — a WebKit memory corruption vulnerability fixed in iOS 18.7.3 (12 December 2025) and iOS 26.2.
Apple states in its security bulletins that CVE-2025-43529 may have been exploited as part of a highly sophisticated attack against specific targets on iOS versions prior to 26. However, Apple does not directly link this exploitation to the Packagist-based campaign described here.
According to the researchers, after successfully exploiting WebKit, the attack escapes the WebContent sandbox, passes through the GPU process, and reaches the kernel, obtaining read and write privileges. It should be noted that details of this stage of the chain are based solely on the Socket report and have not been confirmed by independent sources.
Spyware functionality and cryptocurrency theft
As reported by the researchers, the final payload collects an extensive range of data from the device: Keychain databases, Wi-Fi passwords, SMS messages, address book, photos, browser cookies, call history, location history, and account databases. The collected data is encrypted with AES and transmitted via HTTPS POST to a rotating pool of command-and-control servers.
Around 12 August 2026, the iOS exploitation chain was reportedly updated. The new version targets devices running iOS 18.4–18.6.x and adds a cryptocurrency wallet theft component. The malware queries the iOS Keychain password store for seed phrases and mnemonic keys from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX wallets, expanding the attack vector from data collection to direct financial theft.
Additionally, the researchers note that the same five namespaces have published other theme packages which, at the time of analysis, did not contain an active malicious payload but were configured in such a way that malicious code could be activated via “Custom JS” fields rendered on every page of the site.
Indicators of compromise
Among the confirmed indicators of compromise listed in the Socket report:
- Beacon domain: cloudfareintcdn[.]com
- Exploit status endpoint:
cloudfareintcdn[.]com/wd-status.html - Exfiltration endpoint:
/upload(HTTPS POST)
Impact assessment
Two categories of victims are at risk. Site visitors — any iPhone XS or newer user running iOS versions 18.4–18.6.x who visits an infected site via mobile Safari faces full device compromise without any interaction beyond loading the page. All mobile visitors, regardless of platform, are subjected to redirects to fraudulent resources. Site operators running OphimCMS and KKPhim who have installed the trojanized themes unwittingly turn their sites into platforms for distributing malicious code.
Geographically, the campaign is focused on a Vietnamese audience — users of streaming movie and comics sites — but the technical infrastructure of the attack is not limited by region.
Response recommendations
For site operators on OphimCMS and KKPhim:
- Check whether any of the 13 listed packages are present in your Composer dependencies.
- Immediately remove any detected malicious packages.
- Rotate all credentials — databases, API keys, administrative passwords.
- Audit all linked jQuery scripts and theme files for injected JavaScript, including reviewing “Custom JS” fields.
- Check network logs for connections to the
cloudfareintcdn[.]comdomain.
For iPhone users:
- Update iOS to at least version 18.7.3 or 26.2, where CVE-2025-43529 is fixed.
- Users of Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX cryptocurrency wallets should verify the integrity of their seed phrases and, if compromise is suspected, move their funds to new wallets.
This campaign demonstrates the effectiveness of supply-chain attacks via package manager ecosystems: compromising a single Composer theme turns every site visitor into a potential victim. The highest-priority actions are to immediately audit Composer dependencies for packages from the five specified namespaces and to update iOS on all devices to current versions that include fixes for CVE-2025-31277 and CVE-2025-43529.
