-
Security researchers discovered 13 trojanized Composer theme packages on Packagist that target movie and comic streaming websites to inject harmful scripts.
-
The injected code triggers mobile ad fraud and launches a WebKit-to-kernel exploit chain against unpatched iPhones to gain full system control.
-
Updated malware strains steal personal photos, messages, and save Keychain recovery seeds for popular cryptocurrency wallets like Trust Wallet and Phantom.
Cybersecurity professionals have discovered an alarming supply chain assault against open-source software. The scheme contains forged packages of open-source software meant to deceive unwary mobile users.
The attack targets users visiting specific entertainment platforms while using outdated mobile devices. Cyber criminals injected hidden code inside widely used web scripts to run ad fraud and steal private financial data.
Discovery of Malicious Packagist Packages
Security firm Socket recently exposed thirteen malicious Composer theme packages hosted on the official Packagist repository. These infected files target popular open-source content management systems like OphimCMS and KKPhim, which power various online platforms.
Site owners unwittingly installed these trojanized themes and served harmful scripts to their online visitors. The malicious code spreads across five separate vendor namespaces, including vsmov, vsphim, haiau009, chilltvcms, and ophimcms.
The malicious packages secretly append extra JavaScript right after standard web code. Moreover, this particular case is a part of a larger operation that was already discovered by security experts in March this year. The earlier operation involved six compromised packages to influence web traffic, add ads, and steal confidential data.
The threat actors built these packages so that inactive themes could still execute harmful commands through custom script fields on host websites. Consequently, host sites running these packages remain vulnerable even if they do not actively display the malicious themes.
The Dual Payload and WebKit Exploit Chain
When a user opens an affected web page, the hidden JavaScript inspects the visiting device. Non-iPhone mobile users face an ad-fraud pipeline that forces unwanted gambling links and ad banners on their screens.
Unsuspecting visitors get redirected automatically to shady online casinos through Funnull hosting servers. The ad-fraud system operates continuously on all mobile web browsers to generate illicit revenue for the attackers.
However, the attack turns far more dangerous when an unpatched iPhone loads the page. The script creates a hidden HTML iframe to read the exact system version of the device.
It then deploys a custom exploit chain resembling the known DarkSword malware kit. The chain weaponizes two WebKit flaws, known as CVE-2025-31277 and CVE-2025-43529, to break out of the mobile browser sandbox.
After bypassing the WebContent sandbox, the payload pushes into the GPU process. Next, it targets the AppleM2ScalerCSCDriver component to gain full kernel read and write access.
Apple fixed the kernel bug in iOS 26.1, but unpatched devices remain completely open to control. The exploit chain specifically targets older devices ranging from the iPhone XS through the iPhone 16 series that still run older software builds.
System Data Collection and Crypto Theft
After the successful exploit gives full access to the kernel, the malware collects large quantities of data from the device. The spyware will capture Wi-Fi passwords, messages, contacts, images, cookies, call history, and local logs from the device.
Additionally, the malware completes encryption of compromised data using secure AES encryption before it sends it out via secure HTTPS connections. The background workers communicate progress back to control domains disguised as content delivery networks.
Around August 12 this year, the fraud group updated its attack method to hack iPhone devices working with iOS 18.4 to 18.6.x versions. The updated virus uses a unique stealer to steal the recovery seeds of digital wallets.
The malware queries the internal iOS Keychain for stored keys tied to major platforms like Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX. As a result, victims lose both private device data and their digital assets.
This financial theft component marks a significant evolution in the threat actor’s overall operational goals. By extracting mnemonic phrases directly from system memory, the attackers gain immediate and permanent access to user funds stored across decentralized networks.
Attribution and Remediation Steps
Metadata timestamps inside the software commits suggest a Vietnamese-operated hacking group built these malicious libraries. Additionally, the infrastructure hosting the exploit files links to Funnull, an entity sanctioned by the United States government for supporting massive online fraud operations.
The connection highlights how organized cybercrime networks leverage shared hosting assets to run multi-stage exploitation campaigns across international borders.
Website administrators using open-source PHP frameworks like OphimCMS must immediately check their software setup for compromised themes. Security experts recommend removing all identified packages from project folders, rotating all system credentials, and thoroughly auditing code libraries for hidden scripts.
Site operators should also examine all custom JavaScript inputs to ensure no secondary payloads remain embedded inside their databases.
Furthermore, iPhone users should update their devices past iOS 18.6.x immediately to block these security exploits. Keeping mobile operating systems updated ensures that WebKit vulnerabilities and kernel escape flaws cannot be weaponized by rogue scripts.
A separate incident in Italy highlights the importance of updates. Paragon’s Graphite spyware compromised Fanpage editor Francesco Cancellato’s iPhone in December 2024 without any user interaction. Italian prosecutors confirmed the hack in March 2026, but the attackers remain unknown. Protecting mobile hardware through timely software patches remains the best defense against complex supply chain attacks.
