Listen to this Post
A New Threat Hides Inside Website Themes
A seemingly ordinary website theme can become something far more dangerous when attackers tamper with the software developers trust and distribute it through legitimate package repositories. That is exactly what cybersecurity researchers are warning about after discovering 13 malicious Composer packages on Packagist that were designed to infect Vietnamese movie and comic streaming websites.
The campaign is particularly concerning because it does not rely on a victim downloading an obvious malicious application. Instead, the attack can begin when someone simply visits a compromised website. For ordinary visitors, the page may appear to be nothing more than a movie, television, or comic streaming portal. Behind the scenes, however, injected JavaScript can redirect mobile users into advertising and gambling networks while attempting to exploit vulnerable iPhones.
For users running outdated versions of iOS, the consequences can be dramatically more serious. Researchers say the malicious infrastructure can deploy an exploit chain capable of escaping Apple’s WebKit sandbox, reaching the kernel, and installing spyware designed to steal highly sensitive information—including passwords, messages, photographs, browser data, location history, and cryptocurrency wallet recovery material.
Thirteen Malicious Composer Packages Discovered
Security researchers identified 13 trojanized Composer theme packages distributed across five vendor namespaces on Packagist. The packages were designed to look like themes associated with OphimCMS and related Vietnamese streaming platforms, making them considerably more difficult to recognize as malicious components.
The identified packages include:
vsmov: theme-dy, theme-rrdyw, theme-motchill, theme-vsmov
vsphim: theme-heovl, theme-thempho
haiau009: kkphim-legend, kkphim-motchill
chilltvcms: theme-legend
ophimcms: theme-dy, theme-motchill, theme-pcc, theme-rrdyw
The important detail is that these packages are not simply unwanted advertising tools. According to the researchers, the modified themes contain JavaScript capable of initiating a multi-stage attack against visitors.
The Attack Begins With a Normal Web Page
The attack is designed to blend into ordinary website activity. Once a compromised theme is installed by a site operator, the malicious JavaScript is injected into pages delivered to visitors.
For most mobile users, that code can trigger advertising manipulation and redirect chains associated with gambling and other potentially unwanted destinations. This creates a profitable layer for the attackers even when the more dangerous iOS exploitation stage does not succeed.
The result is an unusual combination of cybercrime techniques: website compromise, advertising fraud, malicious redirects, exploit delivery, spyware deployment, and cryptocurrency theft can all become part of the same operation.
iPhone Users Face the Most Dangerous Stage
The campaign becomes significantly more serious when the visitor is using an iPhone that has not received the necessary security updates.
Researchers say the malicious JavaScript inserts a hidden iframe into the page. That iframe checks the visitor’s iOS environment and determines which version of the exploit chain should be delivered.
This means the victim does not necessarily have to download a suspicious application, approve an installation, or interact with an obvious malicious file. In the reported attack scenario, visiting a compromised website through mobile Safari can be enough to expose an unpatched device to the exploit chain.
Two WebKit Vulnerabilities Form the Initial Entry Point
The iOS attack reportedly abuses two WebKit vulnerabilities: CVE-2025-31277 and CVE-2025-43529.
The first vulnerability was addressed by Apple in iOS 18.6, while the second was patched in later iOS releases, including versions 18.7.3 and 26.2 according to the supplied research.
The researchers said the exploitation approach resembles techniques previously associated with the DarkSword exploit kit. The significance is not simply that two vulnerabilities exist, but that they are chained together to move an attack from a browser context toward deeper parts of the operating system.
Breaking Out of the Browser Sandbox
Modern mobile operating systems deliberately isolate browser content from the rest of the device. If a malicious webpage crashes or compromises browser code, the sandbox is supposed to prevent the attacker from freely accessing the operating system.
The campaign described by Socket attempts to defeat that protection.
According to the researchers, the exploit first compromises WebKit and then pivots into the GPU process. From there, a second stage attempts to reach the kernel through Apple’s AppleM2ScalerCSCDriver IOKit user client.
Successfully reaching the kernel represents a major escalation. Kernel-level privileges provide an attacker with substantially more control than ordinary browser-level access and can potentially allow security boundaries to be bypassed.
Kernel Access Changes Everything
The most alarming component of the campaign is the reported use of kernel read and write capabilities.
With those privileges, the malware can move beyond the information normally available to a website or browser. Researchers say the final payload can access sensitive databases and device information that would otherwise be protected.
The reported collection includes Keychain databases, Wi-Fi passwords, SMS data, contacts, photographs, browser cookies, call history, location history, and account databases.
This is the point where an ordinary malicious advertising campaign becomes a full surveillance threat.
Stolen Data Is Encrypted and Exfiltrated
The malware reportedly encrypts collected information using AES before sending it to attacker-controlled infrastructure over HTTPS.
Researchers observed an upload mechanism using a /upload endpoint, while exploitation progress was reportedly communicated through a separate status path.
The use of encryption and HTTPS makes the traffic less obvious than plaintext data theft. Although HTTPS itself is normal and essential on the modern internet, encrypted communication can make network inspection more dependent on endpoint telemetry, domain reputation, behavioral detection, and other security controls.
The Campaign Returned in August 2026
The threat actors reportedly redeployed the iOS attack chain around August 12, 2026, suggesting that this was not a one-time experiment.
The newer deployment was said to focus primarily on devices running iOS 18.4 through 18.6.x. Researchers also reported that the updated payload expanded the malware’s capabilities by adding cryptocurrency wallet seed and mnemonic theft.
That development is particularly significant because cryptocurrency recovery phrases can provide direct access to digital assets.
Cryptocurrency Wallets Become a Primary Target
The updated malware reportedly searches
The researchers specifically identified:
Bitget
BitKeep
Bitpie
Phantom
Tonkeeper
Trust Wallet
OKX
The shift toward wallet seeds and mnemonic phrases suggests that the attackers are not interested solely in surveillance or credential harvesting.
A stolen password can sometimes be reset. A stolen cryptocurrency recovery phrase can be considerably more dangerous because it may provide the attacker with the ability to reconstruct access to a wallet elsewhere.
The Victim Does Not Have to Own Cryptocurrency
Another important point is that the attack does not necessarily know whether a visitor owns digital assets before attempting the theft.
The malware can search for relevant wallet information as part of its broader collection process. This reflects a common criminal strategy: collect as much valuable information as possible and determine its usefulness afterward.
For an ordinary visitor, the compromise could therefore remain invisible until an account, wallet, or other sensitive service is later accessed by an attacker.
Website Owners Are Victims Too
The operators of compromised streaming websites are also exposed by this campaign.
A site administrator may install what appears to be a legitimate theme package without realizing that it contains malicious code. Once installed, the website becomes an unwitting delivery platform.
This creates a dangerous chain:
Malicious package → compromised website → legitimate visitor → exploit delivery → device compromise → data theft.
The website owner may therefore become both a victim and an accidental distributor of malware.
Additional Packages May Be Dormant
Researchers also found additional theme packages associated with the same five vendor namespaces that did not appear to contain an active payload during analysis.
That does not necessarily mean they are safe.
According to the investigation, some packages were configured so that malicious code could potentially be activated through Custom JS fields rendered across website pages.
This creates an important distinction between malware that is currently executing and code that has been positioned for later activation.
Why Dormant Malware Still Matters
A package without an immediately visible payload should not automatically be considered harmless.
Attackers can deliberately separate deployment from activation. A compromised theme might initially behave normally while the attackers wait for the right opportunity to activate malicious JavaScript.
This approach can make detection more difficult because automated analysis performed at a single point in time may conclude that a package is benign.
For defenders, historical package versions, configuration changes, injected scripts, and unusual external domains can therefore be just as important as the current package contents.
Funnull Infrastructure Appears in the Attack Chain
The researchers linked the exploit infrastructure to servers associated with Funnull.
The supplied investigation states that Funnull had been sanctioned by the United States in May for facilitating romance-baiting scams associated with more than $200 million in cryptocurrency losses.
Infrastructure overlap does not, by itself, establish the identity of the operators behind this specific campaign. Criminal groups frequently reuse, rent, compromise, or redirect infrastructure.
Nevertheless, the connection provides investigators with another potential source of intelligence for tracking the operation.
Who Is Behind the Campaign?
The identity of the attackers remains unclear.
Researchers reportedly believe the campaign may involve a Vietnamese-operated group, partly because of timestamps and metadata found in software commits.
That should be treated as an assessment rather than definitive attribution. Metadata can provide valuable clues, but it is not proof of nationality or the physical location of threat actors.
Attackers can manipulate timestamps, use shared development infrastructure, outsource portions of campaigns, or deliberately plant misleading clues.
The Campaign Has Been Evolving
One of the most important observations is that the malware has apparently changed over time.
The earlier campaign documented in March 2026 involved six malicious Packagist packages masquerading as OphimCMS themes. Their capabilities included visitor redirection, URL exfiltration, advertisement injection, and delivery of secondary payloads hosted on Funnull-related infrastructure.
The later campaign appears more ambitious, adding an iOS exploit chain and cryptocurrency wallet targeting.
That progression suggests an operation that is actively developing its monetization strategy rather than simply distributing a static piece of malware.
Why Streaming Websites Are Attractive Targets
Movie and comic streaming sites can generate enormous numbers of visitors while often operating with comparatively limited security resources.
That makes them attractive to attackers.
Instead of individually targeting thousands of iPhone users, an attacker can compromise a website and allow the website’s existing audience to deliver the victims automatically.
The website effectively becomes an exploit distribution network.
The Scale Can Become Difficult to See
Traditional malware campaigns often leave obvious indicators such as malicious applications, executable files, or phishing emails.
A malicious webpage can be much harder for the average person to recognize.
A user may see a movie player, an advertisement, a loading screen, or a redirect and assume that the website is simply poorly designed.
Meanwhile, malicious JavaScript can operate behind the visible page.
This difference between what the user sees and what the browser executes is one of the central dangers of modern web-based exploitation.
iOS Security Depends Heavily on Patch Levels
Apple’s security architecture makes sophisticated attacks expensive and technically difficult, but security boundaries are not absolute.
When critical vulnerabilities remain unpatched, attackers can attempt to chain them together.
That is why the reported targeting of iOS 18.4 through 18.6.x is so important. A device does not have to be permanently outdated to be vulnerable. Being several security releases behind can sometimes be enough for a threat actor to exploit a newly disclosed or previously weaponized weakness.
Automatic Updates Become a Security Control
The incident is another reminder that operating-system updates should not be viewed merely as feature upgrades.
Security patches can close the exact entry points that sophisticated exploit chains depend upon.
For users who postpone updates because their device appears to be working normally, the danger is that browser-based attacks do not require the user to notice anything wrong beforehand.
The safest approach is to keep iOS and other software components fully updated whenever possible.
The Attack Demonstrates the Power of Supply-Chain Abuse
The most interesting technical aspect of this campaign may actually be the initial compromise vector.
The attackers reportedly did not need to compromise every streaming website individually.
By poisoning software packages used by those websites, they could potentially turn developers and administrators into unwitting participants.
This is classic software supply-chain abuse.
A developer trusts the package repository. The website trusts the developer. Visitors trust the website. The attacker attempts to exploit that entire chain.
Packagist Is Part of a Much Larger Software Ecosystem
Composer and Packagist are widely used within the PHP ecosystem.
That makes malicious package discovery particularly important for developers, because package managers are fundamentally built around trust and convenience.
The lesson extends well beyond these 13 packages.
Organizations should understand which third-party dependencies their applications use, where those dependencies originate, which versions are installed, and whether those packages have changed unexpectedly.
Website Administrators Should Investigate Immediately
Operators of OphimCMS and KKPhim-based websites should treat the discovery seriously.
The first step is to determine whether any of the identified packages were ever installed.
If they were, simply deleting the package may not be enough.
Administrators should investigate generated JavaScript, cached files, templates, theme modifications, configuration values, access logs, administrator accounts, and external network connections.
Credentials Should Be Rotated After Compromise
If a malicious theme was installed, administrators should assume that sensitive credentials may have been exposed.
That includes website administrator credentials, hosting credentials, database passwords, API keys, deployment credentials, and other secrets that may have been accessible from the affected environment.
Credential rotation should ideally occur from a known-clean system after the compromised environment has been investigated.
JavaScript Auditing Is Especially Important
Because the reported attack relies heavily on injected JavaScript, defenders should inspect theme scripts and page templates for unexpected code.
Particular attention should be paid to unfamiliar external domains, hidden iframes, obfuscated JavaScript, unusual redirect logic, dynamically generated script tags, and code that fingerprints mobile devices.
Legitimate third-party scripts should also be inventoried so administrators can distinguish normal functionality from malicious additions.
Deep Analysis
Command 1 — Search Installed Composer Packages
Administrators can begin by reviewing the
composer show
For a more focused review:
composer show | grep -Ei 'theme-dy|theme-rrdyw|theme-motchill|theme-vsmov|theme-heovl|theme-thempho|kkphim|theme-legend|theme-pcc'
The goal is not to assume that every matching string proves compromise, but to identify installations requiring immediate investigation.
Command 2 — Inspect Composer Metadata
Review the
grep -Ei 'vsmov|vsphim|haiau009|chilltvcms|ophimcms' composer.json composer.lock
A lock file can be particularly valuable because it records the exact dependency versions used by the project.
Command 3 — Search Theme Files for Suspicious JavaScript
Search the
grep -RniE '<iframe|document.createElement|eval(|atob(|fromCharCode|innerHTML|appendChild' /path/to/theme/
This is a starting point rather than a complete malware scanner. Obfuscated JavaScript can use many different techniques.
Command 4 — Review External Script References
Look for unexpected domains and remote JavaScript:
grep -RniE 'https?://|script.src=|fetch(|XMLHttpRequest|navigator.userAgent' /path/to/theme/
Unexpected external resources deserve additional investigation, especially when they were introduced recently.
Command 5 — Check Recently Modified Files
On Linux servers, administrators can look for recent modifications:
find /var/www -type f -mtime -30 -printf '%TY-%Tm-%Td %TH:%TM %p ' | sort
Unexpected changes to templates, JavaScript, configuration files, or Composer directories can provide useful clues.
Command 6 — Review Web Server Logs
Search access logs for suspicious redirects, unusual status codes, or requests involving known malicious infrastructure:
grep -Ei 'iframe|upload|wd-status|cloudfareintcdn|funnull' /var/log/nginx/access.log
Log locations differ between systems, so administrators should adapt the command to their server configuration.
Command 7 — Preserve Evidence Before Cleaning
Before deleting suspicious files, affected organizations should preserve copies and relevant logs where possible.
tar -czf incident-evidence-$(date +%F).tar.gz /path/to/suspected/files /var/log/nginx/
Evidence preservation can help determine when the compromise occurred and whether credentials or customer information may have been exposed.
What Undercode Say:
This Is More Than a Malicious Theme Problem
The real story is not simply that 13 packages were found carrying malicious code. The larger issue is that attackers are turning trusted digital infrastructure into a delivery mechanism for attacks against ordinary users.
The Website Becomes the Weapon
In this campaign, the website itself can become part of the attack chain. Visitors do not necessarily need to download a suspicious application because the browser is being used as the initial attack surface.
Supply-Chain Trust Is Being Exploited
Developers typically install packages because they expect package repositories to make software distribution easier and safer. Attackers understand that trust and are increasingly looking for opportunities to poison it.
The Victim May Never See the Attack
A successful exploitation attempt can occur behind a normal-looking webpage. The visitor may watch a video, browse a comic, or simply open a page without realizing that malicious code has been executed.
The iPhone Component Raises the Stakes
The reported browser-to-kernel chain transforms what might otherwise be an advertising-fraud campaign into a serious device-compromise threat.
Kernel Access Is the Critical Escalation
Browser exploitation is dangerous, but escaping the browser sandbox and obtaining kernel-level capabilities can provide attackers with a much broader attack surface.
Personal Data Becomes a Treasure Trove
Messages, photographs, contacts, browser cookies, Wi-Fi credentials, call history, locations, and account information can collectively create an extremely detailed picture of a victim.
Cryptocurrency Theft Adds a Direct Financial Motive
The addition of wallet seed and mnemonic theft is especially worrying because cryptocurrency credentials can potentially translate directly into financial losses.
Recovery Phrases Are Particularly Sensitive
A wallet seed is fundamentally different from an ordinary website password. If exposed, changing a website password does not solve the problem. The affected wallet may need to be abandoned and its assets moved to a new wallet.
The Campaign Appears Financially Motivated
Advertising fraud, gambling redirects, stolen credentials, personal information, and cryptocurrency wallet material provide multiple monetization opportunities.
Attackers Can Monetize Different Victims Differently
One visitor might generate advertising revenue. Another might expose valuable credentials. A third might possess a cryptocurrency wallet. The same infrastructure can therefore serve multiple criminal objectives.
Streaming Audiences Are Valuable
High-traffic entertainment websites give attackers a potentially enormous pool of visitors without requiring direct phishing against every individual.
Website Owners Can Become Unwitting Distributors
The operators may have no malicious intent whatsoever. Installing a compromised theme can effectively transform a legitimate site into a malware delivery platform.
Removing the Package Is Not Enough
If malicious JavaScript or configuration was already deployed, uninstalling the original package may leave behind additional modifications.
Incident Response Must Look Beyond Composer
Administrators should inspect templates, scripts, databases, logs, user accounts, cron jobs, caches, and deployment systems.
Credentials Should Be Treated as Potentially Exposed
If the compromised website had access to sensitive secrets, changing passwords and rotating API keys should be part of the response.
The Attack Shows Why Patch Management Matters
A sophisticated exploit chain becomes considerably less useful when its underlying vulnerabilities have been patched.
Outdated Phones Can Become the Weak Link
Even if a website is compromised for only a short period, visitors using vulnerable operating-system versions can become targets during that window.
Browser Security Is Not Infallible
Web browsers are heavily defended, but browser vulnerabilities remain valuable to attackers because browsers interact directly with untrusted internet content.
Hidden Iframes Remain Useful to Attackers
An invisible iframe can allow malicious logic to load separately from the visible content, helping attackers conceal the technical behavior from ordinary visitors.
Device Fingerprinting Can Make Attacks Selective
Checking the operating-system version allows attackers to determine whether a particular visitor is potentially exploitable instead of blindly delivering the same payload to everyone.
Selective Exploitation Can Reduce Detection
If the exploit is only served to specific devices, security researchers and automated scanners may not always observe the entire attack chain.
Dormant Code Creates Another Problem
Packages that currently show no active payload may still deserve investigation if they contain mechanisms capable of loading or activating malicious JavaScript later.
Attribution Should Remain Cautious
Commit timestamps and language-related clues can help researchers form hypotheses, but they should not be treated as conclusive proof of who operates the campaign.
Infrastructure Reuse Does Not Equal Attribution
The presence of Funnull-related infrastructure can be an important investigative clue, but infrastructure can be reused or controlled by multiple criminal actors.
The August Redeployment Matters
The reported August 12 redeployment demonstrates that defenders cannot assume an earlier campaign has simply disappeared.
Malware Evolution Is a Warning Sign
The addition of cryptocurrency wallet targeting indicates that the attackers are capable of modifying their payload as opportunities change.
The Campaign Combines Several Criminal Models
Ad fraud, malicious redirects, exploitation, spyware, information theft, and cryptocurrency theft are being combined into one ecosystem.
Developers Need Software Provenance
Organizations should know who publishes their dependencies, whether packages are actively maintained, and whether updates introduce unexpected behavior.
Dependency Locking Helps With Reproducibility
Lock files can make it easier to determine exactly which package versions entered an environment and when they changed.
Continuous Monitoring Is Better Than One-Time Scanning
A package can be safe during one analysis and malicious later. Monitoring changes over time provides stronger protection.
Web Security Needs Endpoint Security Too
A website firewall can help protect the server, but it cannot guarantee that a visitor’s device is protected against a browser exploit.
Mobile Users Should Update Immediately
Keeping iOS current is one of the simplest defenses against known browser and kernel vulnerabilities.
Cryptocurrency Users Need Additional Discipline
People who hold digital assets should treat seed phrases and recovery mnemonics as exceptionally sensitive secrets and avoid storing them in places that malware can access.
The Biggest Lesson Is Trust
The attack demonstrates how modern cybercrime increasingly targets the relationships between software developers, package repositories, website operators, and their users.
The Web Is Becoming an Interconnected Attack Surface
A vulnerability in a package can become a website compromise. A website compromise can become a browser exploit. A browser exploit can become a kernel compromise. A kernel compromise can become financial theft.
Small Software Changes Can Have Massive Consequences
A malicious theme may look like a minor dependency problem, but once deployed at scale, it can become the first stage of a sophisticated cyberattack.
Defense Must Follow the Entire Chain
Organizations should not focus exclusively on package security. They need visibility across dependencies, applications, web servers, browsers, endpoints, credentials, and external network traffic.
This Campaign Should Be Treated as a Broader Warning
The discovery is a reminder that legitimate software ecosystems can be abused as weapons and that website visitors may become victims without intentionally installing anything malicious.
Undercode’s Bottom Line
The most dangerous part of this campaign is its simplicity from the victim’s perspective: visit a compromised website, and the attack can begin.
That makes patching, dependency auditing, website integrity monitoring, credential rotation, and endpoint security essential rather than optional.
✅ Confirmed within the supplied research: Security researchers identified 13 malicious Composer theme packages across five vendor namespaces, with the packages reportedly designed to inject JavaScript into affected websites.
✅ Supported by the supplied technical report: The campaign reportedly uses an iOS exploit chain involving CVE-2025-31277 and CVE-2025-43529, followed by an attempted kernel-level escalation and extensive data collection.
❌ Not independently established by the supplied evidence: The identity and nationality of the attackers remain uncertain, and the connection to a Vietnamese-operated group should be treated as a researcher assessment rather than definitive attribution.
Prediction
(+1) The campaign will likely push more website operators toward aggressive dependency auditing. Once malicious packages are shown to be capable of turning legitimate websites into exploit-delivery platforms, organizations are likely to place greater emphasis on software provenance and dependency monitoring.
(+1) Apple’s security updates should significantly reduce the exploitable population. As vulnerable iOS versions become less common, the economics of deploying an expensive browser-to-kernel exploit chain against those devices should become less attractive.
(+1) Cryptocurrency theft will probably remain a major objective. The reported addition of wallet seed and mnemonic collection suggests that attackers are increasingly looking beyond conventional credentials toward information that can produce immediate financial returns.
(+1) Threat actors are likely to continue abusing high-traffic websites. Entertainment, streaming, download, and other heavily visited websites provide an efficient way to reach large numbers of potential victims.
(-1) Unpatched devices will remain disproportionately exposed. Even when vulnerabilities have been publicly fixed, users who delay updates can remain attractive targets for exploit campaigns.
(-1) Compromised websites may continue spreading the threat unknowingly. Unless administrators actively inspect dependencies and deployed scripts, malicious themes can remain embedded in websites long after the original package installation.
(+1) Supply-chain security will become an increasingly important part of web security. The incident demonstrates that protecting the application itself is not enough when third-party components can introduce malicious functionality before the application reaches its users.
Final Warning for Website Operators
Administrators running affected OphimCMS or KKPhim environments should check their Composer dependencies against the reported package list, remove confirmed malicious components, inspect deployed JavaScript and theme files, review logs for suspicious activity, rotate potentially exposed credentials, and investigate whether visitors may have been exposed.
For ordinary iPhone users, the most important defensive action is simpler: keep iOS fully updated and avoid treating unexpected redirects, aggressive advertisements, or unusual website behavior as merely an annoyance.
The deeper lesson is difficult to ignore. In today’s interconnected software ecosystem, a malicious package can quietly move from a developer’s dependency folder to a website, from that website into a visitor’s browser, and from the browser into the deepest layers of a device.
What begins as a theme can ultimately become a doorway to someone’s entire digital life—and, increasingly, to their money.
Correct the package count and list
Make the fact-checking heading consistent
▶️ Related Video (86% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.facebook.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
