Packagist Themes Ios Spyware

Thirteen malicious Packagist themes expose visitors on unpatched iPhones to a WebKit-to-kernel exploit chain that steals device data and wallet seeds.

Socket’s Threat Research Team found 13 malicious Composer theme packages on Packagist, published across five vendor namespaces, that inject JavaScript into every page of the Vietnamese movie and comic streaming sites that install them. The injected code runs two operations against a site’s visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware. We reported the iOS chain to Apple and coordinated disclosure. Apple confirmed the kernel escape was already fixed in iOS and macOS 26.1 before our report, and the two WebKit entry points are public and listed in CISA's Known Exploited Vulnerabilities catalog. Our earlier research covered six themes under a single vendor ( ophimcms ); this expands the confirmed set to 13 packages across five vendors and follows the chain through to the iOS payload and its most recent redeployment.

vsmov : theme-dy , theme-rrdyw , theme-motchill , theme-vsmov

vsphim : theme-heovl , theme-thempho

haiau009 : kkphim-legend , kkphim-motchill

chilltvcms : theme-legend

ophimcms : theme-dy , theme-motchill , theme-pcc , theme-rrdyw

Our report in March regarding the initial FUNNULL campaign named six ophimcms themes (theme-dy, theme-mtyy, theme-rrdyw, theme-pcc, theme-motchill, theme-legend). The theme-legend payload has since relocated to chilltvcms/theme-legend and haiau009/kkphim-legend (counted under those vendors above).

OphimCMS and KKPhim are open source PHP content management systems, built on Laravel, used to run Vietnamese-language movie and comic streaming sites. A site operator installs a core package plus a theme with composer require . The theme ships the site’s front-end assets: jQuery, sliders, players, and site scripts.

The threat actors fork these projects under their own vendor namespaces, keep the scaffolding intact, and trojanize the shipped front-end assets. A site operator who installs one of these themes serves malicious JavaScript to every visitor. The upstream author handle remains inside the forks, so these are hostile republishes.

The malicious code ships in the theme JavaScript. The loaders gate on platform and referrer so that mobile visitors are targeted while desktop browsers, bots, and direct visits are passed over.

indexbottom.js and the ADTOPLB plugin in topinfo.js (theme-rrdyw) inject a fixed banner for mobile visitors that links to a redirect host and loads ad images from im[.]ue8im[.]com . The banner is built only when the visitor’s user agent matches iPhone, iPod, Android, or iOS:

The banner links to 23[.]225[.]52[.]67:4466/vip344.html , which meta-refreshes to 23[.]225[.]48[.]20:4466/vip/index.php , which sets a session cookie and forwards to a randomized-subdomain .vip gambling landing page on port 7740. The campaign identifier vip344 rides the chain.

Branch two: the iOS WebKit to kernel chain #

theme-dy appends a loader after the shipped jQuery. The loader uses a custom base64 decoder (avoiding the native atob ) and fires on non-desktop platforms arriving with an external referrer. It pulls a second stage from FUNNULL infrastructure. The base64 argument decodes to union[.]macoms[.]la/jquery.min-3.6.8.js , and the loader builds a script element that points at the decoded URL:

union[.]macoms[.]la/jquery.min-3.6.8.js injects cdn[.]data-2920[.]com/app.vue.js , which redirects to www[.]cloudfareintcdn[.]com/in-static.js (a Cloudflare-impersonating domain). That injects a hidden iframe to start-view.html , which reads the iOS version and loads a version-specific WebKit exploit.

The renderer stage weaponizes two WebKit vulnerabilities, annotated in the code as CVE-2025-31277 (iOS 18.4 to 18.5) and CVE-2025-43529 (iOS 18.6 and later). Both are now public, patched, and listed in CISA’s Known Exploited Vulnerabilities catalog, and Apple has acknowledged that CVE-2025-43529 was exploited in a targeted attack against specific individuals. The chain carries per-build, per-chipset offset tables for iOS 18.4 through 18.6.x and iPhone XS through the iPhone 16 family, and targets devices that have not updated past those versions. The exploit builds arbitrary read and write inside the WebContent renderer using JavaScriptCore corruption primitives (object-address disclosure, fake objects, and a corrupted typed array). These renderer CVEs and the staging pattern overlap with the publicly documented “DarkSword” iOS exploit kit .

A first escape stage moves from the renderer into the GPU process, building a cross-process memory primitive with IOSurface and mach messaging and forging pointer-authentication signed pointers.

A second stage reaches the kernel through the AppleM2ScalerCSCDriver IOKit user client, opened from a sandboxed context by pivoting through a mediaplaybackd XPC service. The code opens the driver ( IOServiceOpen type 0) and calls external method selector 1 (the “transform”) with a 432-byte input struct carrying two IOSurface IDs. This driver and interface are the same ones disclosed publicly as CVE-2026-43655 (an AppleM2ScalerCSCDriver use-after-free fixed in iOS 26.5), and the public CVE-2026-43655 proof-of-concept exercises the identical selector-1 / 432-byte / two-IOSurface-ID surface.

The FUNNULL chain’s kernel bug is a distinct primitive from CVE-2026-43655. The public CVE-2026-43655 proof-of-concept is a connection-teardown use-after-free on the scaler’s shared scheduler objects, whereas the FUNNULL chain races the IOSurface backing store to obtain a kernel read and write. Apple Product Security confirmed to us that the chain’s kernel escape was already addressed in iOS and macOS 26.1, so this stage is an n-day used against devices that have not updated. The same driver received further hardening through iOS 26.5 under CVE-2026-43655.

On success, the final payload uses the kernel read to collect keychain databases, Wi-Fi passwords, the SMS database, the address book, Photos, browser cookies, call history, location history, and account databases, encrypts them with AES, and uploads them over HTTPS POST /upload to a rotating pool of command and control domains. The worker beacons exploitation progress to cloudfareintcdn[.]com/wd-status.html .

Redeployment and crypto-wallet escalation #

On 2026-08-12 the operators redeployed the entire iOS chain under fresh filenames (a new orchestrator, stager, renderer, workers, kernel stage, and payload), and rotated the second-stage loader again on 2026-08-17. The filenames continue to return content in parallel. The renderer still weaponizes only CVE-2025-31277 and CVE-2025-43529, and the offset tables still cover only iOS 18.4 through 18.6.x, with no tables for iOS 18.7 or iOS 26, so the operators are targeting unpatched devices rather than attempting current iOS.

The redeployed payload roughly doubled in size and added an iOS-keychain crypto-wallet seed and mnemonic stealer. It queries the keychain for wallet material from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX ( keychain_query_bitget , keychain_query_bitpie , keychain_query_phantom , keychain_query_tonkeeper , keychain_query_trust , mnemonics_vault_ ), extending the campaign from device-data collection to direct financial theft. The payload configuration carries a hardcoded AES key and a per-build channel identifier.

Several capabilities recur across the packages:

Staged, admin-activated payloads: theme-motchill and theme-vsmov ship functions.js containing an MPAd class that builds a element pointed at a config-supplied URL and appends it to the page, executing arbitrary remote JavaScript, plus a full-viewport mp-preload-popup-overlay interstitial ad. theme-dy ships pre-declared ad-injection hooks ( indextop , content_zaixian , play_diyi , and others). These are wired to activate from the fetched second stage or from the theme’s own admin “Custom JS” settings fields, which the themes render into every page unescaped via Blade {!! !!} .

Disguised cryptography: theme-motchill ships jquery.core.min.js , which is a renamed CryptoJS bundle (the JQMP namespace) providing AES and PBKDF2, used by a jquery_beauty() routine keyed off document.referrer and the episode id to sign ad-network requests.t

Encrypted server-side code: theme-thempho is malicious through its shipped JavaScript (the jquery_beauty injection in js.cookie.js ), and it additionally ships its ServiceProvider, route table, controller, and migrations as ionCube-encrypted PHP bytecode. That encrypted code is the theme’s entire account system: email and password login, Google OAuth, registration, and password change. The client posts credentials to /auth/login , and the receiving handler runs as opaque bytecode.

Analytics abuse: tj.js beacons to hm[.]baidu[.]com/hm.js and sdk[.]51[.]la under campaign-specific site IDs.

Anti-analysis: phimv2.3.js installs a devtools-detection redirect to xemphimlau[.]com and, on non-Chrome browsers, blocks F12 and right-click and runs an infinite debugger loop.

Sleeper risk from the same five vendors #

The 13 packages are the confirmed-malicious set. The same five vendor namespaces publish additional theme packages that, as shipped today, carry no active payload. Those packages should be treated as untrusted, for three concrete reasons observed in this campaign:

Same operators: The confirmed-malicious and the currently-inactive packages are authored by the same accounts (one committer email owns both vsmov and vsphim , and the byte-identical phimv2.3.js payload appears under three separate identities). The newest carrier, vsmov/theme-vsmov , was published from the same vsphim GitHub account by the same committer email in July 2026, showing the operators are still adding packages.

The activation mechanism is already present. Every theme in these vendors, including the currently-inactive ones, exposes admin “Custom JS” fields rendered into every page via {!! !!} , and the malicious themes demonstrate the exact staged hooks those fields switch on. An operator can arm an inactive theme through a package update or a change to the site’s stored settings, with no new package required.

Encrypted account code: theme-themphim , published alongside the malicious theme-thempho , ships the same ionCube-encrypted account system as opaque bytecode from the same operator that ships confirmed spyware delivery.

Treat any package from vsmov , vsphim , haiau009 , chilltvcms , or ophimcms as untrusted.

Infrastructure and attribution #

The iOS exploit hosts run on FUNNULL infrastructure. Direct DNS and WHOIS resolution show that cdn[.]data-2920[.]com , www[.]cloudfareintcdn[.]com , and the 20 exfiltration domains CNAME-cloak into yunray[.]ai with self-hosted name servers, and union[.]macoms[.]la resolves through the control plane nqsaaskw[.]com delegated to cdn1[.]ai . Silent Push names Yunray and CDN1 as FUNNULL front infrastructure, and macoms[.]la is the domain family tied to the 2024 Polyfill.io supply-chain incident. The 20 exfiltration domains were bulk-registered in a single burst on 2026-06-02, and all remain live as of the writing of this report. A newer front, abfedgecanme[.]com (name servers abfdns[.]com and galedns[.]com ), fronts the campaign host v7[.]kkphimplayer7[.]com , and the gambling host im[.]ue8im[.]com now resolves through lsmzt[.]cc .

Attribution points to several independent groups that one sanctioned provider, not a single actor or a single-nationality operation. The only connective tissue across the operations below is FUNNULL itself, which is shared provisioning rather than shared personnel.

The shared delivery infrastructure is FUNNULL ( Triad Nexus ), administered by Liu Lizhi, a Chinese national, and sanctioned by OFAC on 2025-05-29 for facilitating over 200 million dollars in cryptocurrency scams.

The Packagist theme operators run on Vietnamese time. Commit metadata across the theme accounts carries a UTC+07:00 (Indochina) signature, and two of the accounts self-identify with Vietnamese names and a Hanoi location, publishing forks of Vietnamese movie-piracy CMS projects. The group’s most central publishing account commits largely from United States Pacific offsets and is tied to the group by shared repositories rather than by a self-declared identity, so we attribute the operation to a Vietnamese-operated group without asserting the personal nationality of every individual. They are FUNNULL tenants, not owners.

The iOS exploit kit is commodity or broker capability. DarkSword's named operators are Russian and Turkish (GTIG-URL) , whereas the FUNNULL chain's kernel stage is a sibling of the public CVE rather than the same bug, consistent with a distinct fork or tenant. The provenance of the FUNNULL variant cannot be resolved from available evidence.

The npm gambling configuration dead-drop described below is a separate operation whose artifacts are Chinese: a UTC+08:00 publish signature across thousands of package versions, Chinese commit messages and runtime strings, and Chinese gambling branding. We found no shared identity, email, handle, or registrant between this gambling operation and the Vietnamese theme operators. They are independent tenants of the same sanctioned provider.

The gambling and ad-fraud redirect hosts ( 23[.]225[.]52[.]67 , 23[.]225[.]48[.]20 , im[.]ue8im[.]com ) run on separate infrastructure from the exploit CDN.

The same FUNNULL address space also carries an unrelated tenant, which illustrates how the provider operates across ecosystems. A Chinese sports-gambling and pirate-streaming operation, documented by Panther Threat Research in May 2026, publishes more than 50 npm packages across four publisher scopes that function purely as a configuration dead-drop. Each package ships a base64-encoded JSON blob whose cdn field decodes to the literal string funnull and which names the current live backend domain, so an installed betting app can resolve a working endpoint as domains are burned and republished every few minutes. Those tenant domains (for example dq87771[.]com ) resolve, through a two-hop kanejwo[.]com to iiauuw[.]com CNAME cloak, into the same Hong Kong FUNNULL address ranges as this campaign’s exploit fronts, and a sibling tenant domain CNAMEs directly to the published FUNNULL indicator funnull01[.]vip . This is a different operator with a different payload, gambling configuration rather than an exploit, riding the same landlord. FUNNULL rents resilient front infrastructure to multiple independent criminal tenants, and npm registry abuse is one tenant’s delivery choice, not a property of the exploit operator.

A visitor to a site that installed one of these themes, on an iPhone that has not been updated past iOS 18.6.x (iPhone XS through iPhone 16), can have their keychain, Wi-Fi passwords, SMS, Photos, contacts, cookies, location history, account databases, and cryptocurrency wallet seeds collected and exfiltrated by loading a page in mobile Safari. The kernel escape was addressed in iOS 26.1 and the WebKit entry points in iOS 18.7.3 and iOS 26.2, so a device updated to iOS 26.2 or later (or iOS 18.7.3 on the iOS 18 line) is not exposed to the known stages; the campaign preys on devices left on older versions. Every mobile visitor is also subject to the gambling-redirect and ad-injection chain. The site operators are victims too: they shipped the trojanized theme unknowingly and serve the payload to their own users.

For site operators using OphimCMS or KKPhim #

Audit installed theme packages against the vendor list below. If you installed a theme from vsmov , vsphim , haiau009 , chilltvcms , or ophimcms , remove it, rotate credentials handled on the host, and inspect shipped jQuery and theme scripts for appended loaders and for the network indicators below.

Pin and review Composer dependencies, including theme and asset packages. Treat front-end assets shipped inside packages as code that executes in your users’ browsers. Review new or low-reputation vendor namespaces before adding them.

Block the network indicators below. Hunt for the session-storage keys rce_locked and uid , the staggered iframe loader, beacons to cloudfareintcdn[.]com/wd-status.html , and the wallet-theft strings ( keychain_query_bitget and siblings). Prioritize updating iPhones off iOS 18.6.x and earlier.

Socket detects threats like this across the full dependency graph, including trojanized front-end assets shipped inside packages, before they reach developer environments. The Socket GitHub App scans pull request dependency changes and flags injected or obfuscated code before merge. The Socket CLI enforces allow and deny rules in CI pipelines. Socket Firewall blocks known malicious packages before they are fetched. The Socket browser extension surfaces risk signals while browsing npm. Socket MCP prevents AI-assisted coding workflows from introducing suspicious dependencies into your codebase.

T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools

T1608.001 - Stage Capabilities: Upload Malware

T1608.004 - Stage Capabilities: Drive-by Target

T1102 - Web Service (npm registry as a dead-drop resolver, related tenant)

T1189 - Drive-by Compromise

T1203 - Exploitation for Client Execution

T1068 - Exploitation for Privilege Escalation

T1027 - Obfuscated Files or Information

T1140 - Deobfuscate/Decode Files or Information

T1480 - Execution Guardrails

T1497 - Virtualization/Sandbox Evasion

T1552.001 - Unsecured Credentials: Credentials In Files (keychain wallet theft)

T1041 - Exfiltration Over C2 Channel

T1071.001 - Application Layer Protocol: Web Protocols

Indicators of Compromise (IOCs) #

Malicious Packagist packages #

haiau009/kkphim-legend

haiau009/kkphim-motchill

chilltvcms/theme-legend

ophimcms/theme-motchill

Threat Actor handles and emails #

Packagist vendors: vsmov , vsphim , haiau009 , chilltvcms , ophimcms

GitHub source account: vsphim

Committer emails: clemenciajohn74@gmail[.]com , dev.cuongnguyen@gmail[.]com , nguyenhai.tran.009@gmail[.]com , xuxuthoi01@gmail[.]com , tuwibu2021@gmail[.]com

Delivery and exploit infrastructure #

union[.]macoms[.]la/jquery.min-3.6.8.js

cdn[.]data-2920[.]com

cdn[.]data-2919[.]com

www[.]cloudfareintcdn[.]com

www[.]0liwevrhxdc3s2xk00[.]com

www[.]39rwcybep-20pwozhvdrzzy[.]net

www[.]5wg3w278e3oamlohmcinrkh[.]live

www[.]dlosdekr1u18msmov51[.]net

www[.]ex0x40vmi8qyccxq[.]net

www[.]ioa7xqmhiz26fv5e[.]info

www[.]isbo31w1o7xk3fztvmgpbv[.]app

www[.]jhflt6l0dwminsl494836rb[.]org

www[.]kp2-3ur6pe4r8i2hj5[.]com

www[.]ljot1cem6jhzfu53yb9aj3h[.]app

www[.]ncalb1rzb2rq5-3zdx1[.]app

www[.]ov86ayb0fe4ep2b92-645o[.]com

www[.]qdh71-y6j7vxgw046v4cvgga[.]live

www[.]sx3cjniwo1bmtqs0vlj-va2f[.]app

www[.]sx8vuz4smtdol7pg[.]com

www[.]t9ffxu6zhf915fadjv1[.]app

www[.]vutjsf0sd9sdqt2rkzvgzv9a[.]org

www[.]w4iunvbdvjof39q-3[.]net

www[.]xtpj2bzxip6iq7n3bnz[.]info

www[.]zfu4n4kxgmx32hsqg[.]cc

23[.]225[.]52[.]67:4466

23[.]225[.]48[.]20:4466

Exploit stage files (SHA-256 Hashes) #

start-view.html : 60b6771958cb7e553994ba6752f108575ba70e02d24affb51d8936a17eb0bf5e

a4tt4g37f36gdd7q7kdc.js (renderer loader, CVE annotations): d9530e8cd79ac7b3d02b04e05426653afca7075fcf7424eec4d59c6e95745933

a84snnb6pknt3aflt01r.js (iOS 18.4 to 18.5 RCE) : 92c7d246d2c163c076f783dcc19f87f5b9b9ac301b106b87a7aaea9346ce0052

921w48jmeqvt3ygn0wwx.js (kernel escape): f2fdfddbc436acc24a654092f5205b2c5bd3208b126b2c2754ac63e7aea22298

4ap5xpu18z70wwslqybu.js (spyware payload): 9d6b58886189c0e23f706c32d3d8dda97b0b6d927ece6de07270813f070295b5

qljbd9a1h4a83gw8lxcj.js (iOS 18.6+ worker): de539a63cbe27bbd4a7db30fc796cd6dc5309c02ef5e60a3c5cf0835e5601283

A parallel chain redeployed on 2026-08-12 serves the same stages under fresh filenames (orchestrator 98jgbibyeep2qfkvcq.html , kernel stage pf2zdl2b4i4cxggjg9s7.js , spyware payload sejpbqlu090u7lz0z6ax.js , among others); full hashes for the redeployed set are recorded in our evidence bundle. The exploit is version-gated at runtime, so the per-iOS-version RCE payloads are served conditionally.

Crypto-wallet spyware #

AES key: 9_X1 M=<;5

Channel identifier: 22c75b2ee026dbbf7001cfdc2bb47855