Trojanized PHP Themes Target Unpatched iPhones

Researchers have uncovered a new supply-chain attack that abuses the trust developers place in open-source package repositories. Thirteen malicious Composer theme packages on Packagist, the default PHP package registry, are designed to infect Vietnamese movie and comic streaming sites with code that, in turn, targets unpatched iPhones visiting those sites, aiming to siphon cryptocurrency wallet seeds and other sensitive data.

Malicious Packages and Their Purpose

According to an analysis by Socket security researcher Kush Pandya, the injected code runs two distinct operations against a site's visitors. On mobile devices, it executes a mobile ad-fraud and gambling-redirect chain; on iPhones, it triggers a WebKit-to-kernel exploit chain that installs spyware.

Socket first documented this campaign back in March 2026, when it identified six malicious Packagist packages posing as OphimCMS themes. Those earlier packages redirected visitors, exfiltrated URLs, injected ads, and served a second-stage payload hosted on infrastructure linked to Funnull, leading victims to gambling and adult content sites.

The newly identified packages span five vendor namespaces:

• vsmov: theme-dy, theme-rrdyw, theme-motchill, theme-vsmov
• vsphim: theme-heovl, theme-thempho
• haiau009: kkphim-legend, kkphim-motchill
• chilltvcms: theme-legend
• ophimcms: theme-dy, theme-motchill, theme-pcc, theme-rrdyw

Attack Chain Mechanics

The trojanized themes inject JavaScript that, when a page loads, inserts a hidden iframe. This iframe determines the iOS version and loads an OS-specific exploit. The exploit chain weaponizes two WebKit vulnerabilities: CVE-2025-31277, patched in iOS 18.6, and CVE-2025-43529, patched in versions 18.7.3 and 26.2. This approach is analogous to the DarkSword exploit kit, a previously documented iOS exploit framework.

After the initial break, the payload escapes the WebContent sandbox into the GPU process, then pivots through the AppleM2ScalerCSCDriver IOKit user client to reach the kernel. Apple has reportedly addressed this kernel escape flaw in iOS and macOS 26.1.

Once the kernel is compromised, the final payload uses kernel read access to collect keychain databases, Wi-Fi passwords, the SMS database, the address book, Photos, browser cookies, call history, location history, and account databases. It encrypts the exfiltrated data with AES and uploads it via HTTPS POST to a rotating pool of command and control domains. The worker also beacons exploitation progress to a domain called cloudfareintcdn[.]com/wd-status.html.

Focus on Crypto Wallets

Threat actors redeployed the entire iOS attack chain around August 12, 2026, primarily targeting iOS devices running versions 18.4 through 18.6.x. This new version adds a keychain cryptocurrency wallet seed and mnemonic stealer, extending the attack's scope from data theft to direct financial theft.

The malware queries the password store for wallet material from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX.

Victims: Site Operators and Visitors

Socket emphasized that the threat is twofold. Visitors to compromised sites are at risk, but so are the site operators themselves, who unknowingly ship the trojanized theme to their users.

A visitor to a site that installed one of these themes, on an iPhone that has not been updated past iOS 18.6.x (iPhone XS through iPhone 16), can have their keychain, Wi-Fi passwords, SMS, Photos, contacts, cookies, location history, account databases, and cryptocurrency wallet seeds collected and exfiltrated by loading a page in mobile Safari.

— Socket security researchers

Potential Attribution and Funnull

The campaign is believed to be the work of a Vietnamese-operated group, based on commit metadata timestamps, though attribution is uncertain. Notably, the iOS exploit hosts run on infrastructure provided by Funnull, an entity sanctioned by the U.S. last May for facilitating romance baiting scams that led to over $200 million in cryptocurrency losses.

Recommendations for Site Operators

Socket advises site operators using OphimCMS or KKPhim to check if they have installed any of the aforementioned packages, remove them if found, rotate credentials, and audit shipped jQuery and theme scripts for indicators of compromise. The same five vendor namespaces have also published additional theme packages that carry no active payload at the time of analysis, but are configured such that the malicious code could be activated via "Custom JS" fields rendered into every page on the websites.

Why This Matters

This campaign illustrates the risks inherent in the open-source ecosystem, where a single compromised package can turn a legitimate website into an attack vector. For the thousands of sites that rely on these themes, the consequences extend beyond their own security to that of every visitor. The targeting of unpatched iPhones, combined with the focus on cryptocurrency wallet seeds, suggests a financially motivated actor that has invested heavily in developing a complex exploit chain. For users, the lesson is clear: applying security updates promptly is critical, as a single unpatched vulnerability can lead to full device compromise. For developers, the incident serves as a reminder of the need to vet third-party components thoroughly, even those from official repositories.