13 Malicious Packagist Themes Deliver iOS Spyware and Steal Crypto Wallet Seeds

Aug 31, 2026 · Original article ↗

Summary

Socket found 13 trojanized Composer themes that inject gambling redirects and, on vulnerable iPhones, a WebKit-to-kernel exploit chain delivering spyware that steals device data and cryptocurrency wallet seeds.

Key points

The 13 malicious themes span five Packagist vendor namespaces and target sites built with the Vietnamese OphimCMS and KKPhim systems.
Trojanized JavaScript is served to site visitors; mobile users also face gambling and ad-fraud redirects.
On vulnerable iPhones, staged loaders deliver WebKit exploits CVE-2025-31277 and CVE-2025-43529, followed by GPU-process and kernel escapes.
The spyware collects keychain data, Wi-Fi passwords, messages, contacts, photos, browser cookies, location history, and other personal data; its redeployed version also steals seeds for seven crypto wallets.
Operators redeployed the iOS chain under new filenames in August 2026; the reported exploit tables target iOS 18.4–18.6.x devices.
Apple confirmed the kernel escape was fixed in iOS and macOS 26.1; the article says the WebKit entry points were fixed in iOS 18.7.3 and iOS 26.2.
Socket advises operators to remove themes from the five named namespaces, rotate affected credentials, review dependencies, block indicators, and update vulnerable iPhones.

Article Details

Attack Vectors: Threat actors republished OphimCMS and KKPhim themes under their own Packagist vendor namespaces, retaining the project scaffolding while trojanizing front-end JavaScript served to site visitors.
The injected loaders target mobile visitors and use platform and referrer checks to avoid desktop browsers, bots, and direct visits.
One branch injects mobile ads and redirects visitors through gambling infrastructure. On iPhones, another branch loads staged WebKit exploits, pivots through the GPU process, and uses a kernel escape to install spyware.
The spyware collects device and account data. A redeployed payload also queries the keychain for cryptocurrency-wallet seeds and mnemonics.
A separately attributed gambling operation uses npm packages containing encoded configuration as a dead-drop for changing backend domains.
Defensive Notes: Site operators should remove themes from vsmov, vsphim, haiau009, chilltvcms, and ophimcms, rotate credentials handled on the host, and inspect shipped jQuery and theme scripts for appended loaders and network indicators.
Developers should pin and review Composer dependencies, including front-end assets, and scrutinize new or low-reputation vendor namespaces.
Security teams should block the reported network indicators and hunt for the session-storage keys rce_locked and uid, staggered iframe loading, status beacons, and wallet-theft strings such as keychain_query_bitget.
The article recommends moving iPhones off iOS 18.6.x and earlier. It states that devices updated to iOS 26.2 or later, or iOS 18.7.3 on the iOS 18 line, are not exposed to the known stages.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`abfdns[.]com`	Name-server domain identified for the campaign's newer front.
DOMAIN	`abfedgecanme[.]com`	Newer front for a campaign host.
DOMAIN	`cdn1[.]ai`	Delegated front infrastructure for the exploit delivery control plane.
DOMAIN	`cloudfareintcdn[.]com`	Domain used for spyware exploitation-progress beacons.
DOMAIN	`cre-ads[.]com`	Domain listed under gambling and ad-fraud indicators.
DOMAIN	`dq87771[.]com`	Example backend domain for the separately attributed gambling tenant.
DOMAIN	`funnull01[.]vip`	Published FUNNULL indicator to which a sibling gambling-tenant domain CNAMEs.
DOMAIN	`galedns[.]com`	Name-server domain identified for the campaign's newer front.
DOMAIN	`iiauuw[.]com`	Second hop in the separate gambling tenant's backend-domain CNAME cloak.
DOMAIN	`kanejwo[.]com`	First hop in the separate gambling tenant's backend-domain CNAME cloak.
DOMAIN	`lsmzt[.]cc`	Infrastructure through which the gambling-image host resolves.
DOMAIN	`nqsaaskw[.]com`	Control-plane domain through which the second-stage host resolves.
DOMAIN	`xemphimlau[.]com`	Destination of a malicious theme script's devtools-detection redirect.
DOMAIN	`yunray[.]ai`	FUNNULL front infrastructure into which delivery and exfiltration hosts CNAME-cloak.
EMAIL	`clemenciajohn74@gmail[.]com`	Committer email listed among threat-actor handles for the malicious theme publishers.
EMAIL	`dev[.]cuongnguyen@gmail[.]com`	Committer email listed among threat-actor handles for the malicious theme publishers.
EMAIL	`nguyenhai[.]tran[.]009@gmail[.]com`	Committer email listed among threat-actor handles for the malicious theme publishers.
EMAIL	`tuwibu2021@gmail[.]com`	Committer email listed among threat-actor handles for the malicious theme publishers.
EMAIL	`xuxuthoi01@gmail[.]com`	Committer email listed among threat-actor handles for the malicious theme publishers.
HOSTNAME	`cdn[.]data-2919[.]com`	Host listed as exploit-delivery infrastructure.
HOSTNAME	`cdn[.]data-2920[.]com`	Exploit-delivery host that serves the next JavaScript stage.
HOSTNAME	`im[.]ue8im[.]com`	Host serving images for the injected gambling banner.
HOSTNAME	`v7[.]kkphimplayer7[.]com`	Campaign host behind the newer front.
HOSTNAME	`www[.]0liwevrhxdc3s2xk00[.]com`	Listed exfiltration C2 host.
HOSTNAME	`www[.]39rwcybep-20pwozhvdrzzy[.]net`	Listed exfiltration C2 host.
HOSTNAME	`www[.]5wg3w278e3oamlohmcinrkh[.]live`	Listed exfiltration C2 host.
HOSTNAME	`www[.]cloudfareintcdn[.]com`	Cloudflare-impersonating exploit-stage host.
HOSTNAME	`www[.]dlosdekr1u18msmov51[.]net`	Listed exfiltration C2 host.
HOSTNAME	`www[.]ex0x40vmi8qyccxq[.]net`	Listed exfiltration C2 host.
HOSTNAME	`www[.]ioa7xqmhiz26fv5e[.]info`	Listed exfiltration C2 host.
HOSTNAME	`www[.]isbo31w1o7xk3fztvmgpbv[.]app`	Listed exfiltration C2 host.
HOSTNAME	`www[.]jhflt6l0dwminsl494836rb[.]org`	Listed exfiltration C2 host.
HOSTNAME	`www[.]kp2-3ur6pe4r8i2hj5[.]com`	Listed exfiltration C2 host.
HOSTNAME	`www[.]ljot1cem6jhzfu53yb9aj3h[.]app`	Listed exfiltration C2 host.
HOSTNAME	`www[.]ncalb1rzb2rq5-3zdx1[.]app`	Listed exfiltration C2 host.
HOSTNAME	`www[.]ov86ayb0fe4ep2b92-645o[.]com`	Listed exfiltration C2 host.
HOSTNAME	`www[.]qdh71-y6j7vxgw046v4cvgga[.]live`	Listed exfiltration C2 host.
HOSTNAME	`www[.]sx3cjniwo1bmtqs0vlj-va2f[.]app`	Listed exfiltration C2 host.
HOSTNAME	`www[.]sx8vuz4smtdol7pg[.]com`	Listed exfiltration C2 host.
HOSTNAME	`www[.]t9ffxu6zhf915fadjv1[.]app`	Listed exfiltration C2 host.
HOSTNAME	`www[.]vutjsf0sd9sdqt2rkzvgzv9a[.]org`	Listed exfiltration C2 host.
HOSTNAME	`www[.]w4iunvbdvjof39q-3[.]net`	Listed exfiltration C2 host.
HOSTNAME	`www[.]xtpj2bzxip6iq7n3bnz[.]info`	Listed exfiltration C2 host.
HOSTNAME	`www[.]zfu4n4kxgmx32hsqg[.]cc`	Listed exfiltration C2 host.
IPV4	`23[.]225[.]48[.]20`	Second gambling-redirect host, which forwards visitors to a landing page.
IPV4	`23[.]225[.]52[.]67`	First gambling-redirect host linked from the injected mobile banner.
SHA256	`60b6771958cb7e553994ba6752f108575ba70e02d24affb51d8936a17eb0bf5e`	Hash of exploit-stage start-view.html.
SHA256	`92c7d246d2c163c076f783dcc19f87f5b9b9ac301b106b87a7aaea9346ce0052`	Hash of iOS 18.4–18.5 RCE stage a84snnb6pknt3aflt01r.js.
SHA256	`9d6b58886189c0e23f706c32d3d8dda97b0b6d927ece6de07270813f070295b5`	Hash of spyware payload 4ap5xpu18z70wwslqybu.js.
SHA256	`d9530e8cd79ac7b3d02b04e05426653afca7075fcf7424eec4d59c6e95745933`	Hash of renderer loader a4tt4g37f36gdd7q7kdc.js.
SHA256	`de539a63cbe27bbd4a7db30fc796cd6dc5309c02ef5e60a3c5cf0835e5601283`	Hash of iOS 18.6-and-later worker qljbd9a1h4a83gw8lxcj.js.
SHA256	`f2fdfddbc436acc24a654092f5205b2c5bd3208b126b2c2754ac63e7aea22298`	Hash of kernel-escape stage 921w48jmeqvt3ygn0wwx.js.