Packagist Themes Exploit iPhone Visitors to Steal Messages, Passwords and Crypto Wallet Seeds

Thirteen malicious Composer themes on Packagist turn Vietnamese OphimCMS and KKPhim streaming sites into drive-by delivery platforms for iPhone spyware. The campaign targets iPhones running iOS 18.4 through 18.6.x, weaponizing two WebKit vulnerabilities (CVE-2025-31277 for iOS 18.4 to 18.5 and CVE-2025-43529 for iOS 18.6.x) to gain arbitrary read and write inside the renderer, then pivots through the GPU process before escaping to the kernel via the AppleM2ScalerCSCDriver IOKit user client. Apple confirmed the kernel escape was fixed in iOS 26.1, while the WebKit entry points were patched in iOS 18.7.3 and iOS 26.2. The trojanized themes include vsmov/theme-dy, vsphim/theme-heovl, haiau009/kkphim-legend, chilltvcms/theme-legend, and multiple ophimcms variants, all installed by site operators through composer require who unknowingly serve malicious JavaScript to every visitor.

The exposure is not abstract: any mobile visitor to a compromised site loads the payload, and iPhone users on unpatched versions face full device compromise rather than simple redirect fraud. The injected code runs two operations in parallel, a gambling redirect chain for Android and iOS that terminates at randomized .vip landing pages on port 7740 with campaign identifier vip344, and the iOS exploit chain that collects keychain databases, SMS messages, contacts, photos, browser cookies, call history, location records, and account data. The redeployed August 2026 payload added targeted keychain queries for cryptocurrency wallet seeds and mnemonics from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX, shifting the operation from broad surveillance to direct financial extraction. The same five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) also publish currently inactive packages that share the same operators, commit metadata, and admin-activated Custom JS hooks, creating sleeper risk across the entire vendor set. This is one of thirty similar supply-chain stories today, but the iOS-to-kernel chain with confirmed crypto-wallet targeting makes it distinct from ordinary theme malware.

Defenders should audit installed Composer themes against the five namespaces, remove any matching packages, rotate affected credentials, and inspect shipped JavaScript for appended loaders such as the base64-decoded loader pointing to union.macoms.la/jquery.min-3.6.8.js. iPhone users should update to iOS 18.7.3 or iOS 26.2 or later. Security teams should hunt for session-storage keys rce_locked and uid, beacons to cloudfareintcdn.com/wd-status.html, the wallet-theft strings keychain_query_bitget and siblings, and HTTPS POST /upload traffic to rotating C2 domains cloaked behind FUNNULL infrastructure. The payload carries a hardcoded AES key (9_X1M=<;5) and per-build channel identifier (22c75b2ee026dbbf7001cfdc2bb47855), which can serve as telemetry markers. Block the delivery hosts including union.macoms.la, cdn.data-2920.com, and www.cloudfareintcdn.com, and treat any package from the five namespaces as untrusted given the documented cross-account collaboration and encrypted ionCube account systems in sibling themes.

The assessment changes if Apple releases an out-of-band patch for iOS 18.6.x before users migrate to 18.7.3, or if the operators deploy offset tables for iOS 18.7 or iOS 26, which would indicate an attempt to extend the campaign to updated devices rather than relying solely on the existing unpatched base. A second development to watch is whether the crypto-wallet seed queries expand beyond the current seven apps, or if the redeployed filenames (orchestrator 98jgbibyeep2qfkvcq.html, kernel stage pf2zdl2b4i4cxggjg9s7.js) appear in new Packagist releases under different vendor namespaces. The original Socket research from March 12 and August 31, 2026, remains the authoritative source for the full IOC set, exploit stage hashes, and infrastructure mapping.