Campaign of 13 issues topped by Composer in Packagist injects JS and steals seeds from purse

Security researchers have detected a campaign that distributes malicious code through 13 packages of Composer themes published in Packagist and directed especially to Vietnamese film and comic sites using third-party templates. The vector is a stumbled theme that injects JavaScript on the pages of affected sites; this script carries out two parallel operations: a redirection / ad-fraud directed at mobile and, in unupdated iPhones, a WebKit operating chain that culminates in the installation of spyware with the capacity to steal sensitive data and cryptomoneda purse seeds.

Technically, the attack is bifurred in two loads: the first is aggressive in terms of advertising fraud and traffic (redirects users to betting sites and adult content), and the second is a browser explosion specifically orchestrated against mobile Safari. The injected JavaScript inserts a hidden iframe that detects the iOS version and downloads an adapted explosion. According to the analysis published by the researchers, the chain exploits two WebKit vulnerabilities (identified as CVE-2025-31277 and CVE-2025-43529) to escape from the WebContent sandbox, to pivote towards the GPU process and, from there, to scale privileges to the kernel through an IOKit client (ApplM2ScalerCSCDriver). The final goal is to get kernel readings / scriptures to extract key key databases (keychain), Wi-Fi passwords, SMS, photos, browser cookies, call history and location, and more; these files are encrypted and exfiltered via HTTPS to a rotation of control and control domains.

The packages involved include five name spaces and 13 themes(including variants for OphimCMS and KKPim), published in Packagist as Composer packages to facilitate installation by site administrators. If your site uses Composer and third-party templates, it is appropriate to check the full list of packages in the PHP general repository: https: / / packagist.org. The investigation indicates that the attackers redeplored the iOS chain around August 12, 2026 with a new stage that adds a mnemonic and purse seed thief for several popular wallet applications (Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet and OKX).

Who's it to? First two groups: operators of sites that installed the stumbled themes (who in many cases are indirect victims who unknowingly distributed the payload) and mobile visitors to these sites. Among visitors, iPhone users with ungrilled iOS (mentioned as versions 18.4-18.6.x in the analysis) are at risk of deep engagement and theft of credentials / assets; all mobile users are subject to the redirection and ad-fraud scheme. The campaign seems to focus on Vietnamese streaming sites, and the technical attribution based on metadata of commit suggests operation from the region, although that connection remains an estimate and not a legal confirmation.

Actual consequences: loss of large-scale privacy and risk of direct financial theft. In addition to the exfiltration of personal data, the ability to capture purse seeds allows the direct emptying of funds if the victims store keys on the device or in mobile applications. Site operators suffer from reputation, possible ad-delivery network blocking, and operational responsibility for distributing malware to their users.

What should a site manager or an affected user do now. For website operators: first, identify if your PHP project uses any of the mentioned packages by looking at composer.lock or running composer show --installed. A quick search on the server can be done with commands like grep -E "vsmov-124; vsphim-124; haiau009-124; chilltvcms-124; ophimcms" composer.lock-n or by inspecting theme folders by suspicious scripts in headers, footers or "Custom JS" fields. If you find any, remove the package, restore the files from clean copies or reinstall the subject from a verified source and rotate all related credentials (SSH / FTP access, API keys, management accounts and database credentials).

In addition, audit jQuery scripts and templates in search of remote insertions that point to unknown domains or iframes (e.g. search for chains such as cloud-fareintcdn or references to external infrastructure). Browse the web server logs for unusual requests to / upload or remote domains, keep the devices for forensic analysis and, if you detect traffic to command and control domains, block them in the network layer or in the WAF. Consider restoring from backups prior to package installation if there are signs of persistent engagement.

For mobile users, and in particular iPhone owners: update iOS immediately to the latest version that corrects WebKit vulnerabilities and kernel escape. Apple publishes security notices and updates on its web; keeping the patched device is the most effective defense against browser operating chains: https: / / support.apple.com / en-us / HT201222. If you suspect that your device was compromised, disconnect it from unreliable networks, review installed applications, change credentials from a secure device and consider that the keys stored locally or in the key chain could have been exfiltered - therefore move funds to cold wallets (hardware) and enable additional security measures to allow it.

Long-term preventive measures: implement scanning of automated units in your pipelines (SCA), limit Composer package sources to verified repositories, implement signature and version blocking policies (pinning), and review mechanisms that allow JavaScript to be injected from CMS-editable fields. To guide on risks in the software supply chain and recommended controls, see community resources such as the OWASP supply chain security project: https: / / owasp.org / www-project-software-supply-chain-security /.

What's confirmed and what's still pending. Confirmed by researchers is the use of Composer packages in Packagist to distribute the malicious JavaScript, the existence of the redirection / ad-fraud chain and the presence of an iOS-oriented operating chain that culminates in data exfiltration. estimates based on metadata and behavior point to an actor linked to Vietnam and to the re-use of infrastructure hosted by Funnill; that attribution is plausible but not definitive. The exact list of victims and the added financial impact still requires an incident-by-incident investigation and the collaboration of network operators and hosting providers to quantify losses.

Act as soon as possible: check composer.lock, update iOS devices, audit and remove suspicious subjects and preserve evidence for research. The chain combines a threat of mass fraud with a real ability to steal digital assets: ignoring it increases the risk for both users and administrators who trust third party packages.