Source: socket.dev
Socket's Threat Research Team discovered 13 malicious Composer/Packagist theme packages across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject malicious JavaScript into Vietnamese movie and comic streaming sites. The injected code runs two operations: a mobile ad-fraud/gambling redirect chain, and on iPhones, a WebKit-to-kernel exploit chain (DarkSword-linked, using CVE-2025-31277 and CVE-2025-43529) that installs spyware. The spyware collects keychain data, Wi-Fi passwords, SMS, contacts, photos, browser cookies, location history, and cryptocurrency wallet seeds from seven wallet apps (Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, OKX). The campaign is attributed to Vietnamese-operated threat actors using FUNNULL infrastructure (sanctioned by OFAC). On 2026-08-12, the operators redeployed with fresh filenames and added crypto-wallet seed theft. The kernel escape was patched in iOS 26.1 and WebKit entry points in iOS 18.7.3/iOS 26.2; unpatched devices remain vulnerable.
