Fast Facts
- Malware-laced Composer themes on Vietnamese streaming sites inject JavaScript for ad-fraud, gambling redirects, and iOS exploit chains leading to spyware installation and cryptocurrency theft.
- The iOS attack exploits WebKit vulnerabilities (CVE-2025-31277 and CVE-2025-43529) to escalate to kernel privileges, stealing sensitive data like keychains, passwords, and photos.
- Victims using unpatched iOS devices (versions before 18.7.3) are especially at risk of data exfiltration and financial theft, with threat actors continually redeploying updated payloads.
Threat, Attack Techniques, and Targets
Cybersecurity researchers discovered 13 malicious Composer theme packages on Packagist. These packages are designed to inject harmful JavaScript into Vietnamese movie and comic streaming sites that install them. When visitors access these sites, two main malicious activities happen. First, they trigger mobile ad-fraud and gambling redirects. Second, on iPhones, the code exploits vulnerabilities in WebKit to install spyware. The spyware can steal sensitive data, such as cryptocurrency wallet seeds, keychain passwords, Wi-Fi passwords, and other personal information.
The attack uses a WebKit-to-kernel exploit chain. It detects the iOS version and loads a specific exploit for that version. It exploits two WebKit vulnerabilities, CVE-2025-31277 and CVE-2025-43529. These exploits break out of the WebContent sandbox and reach the kernel, gaining full access. The malware then collects sensitive data and uploads it to command and control servers. The campaign mainly targets iOS devices running versions 18.4 through 18.6.x. Notably, the threat actors have redeployed the attack with a new payload that adds cryptocurrency wallet seed theft, targeting wallets like Bitget, Trust Wallet, and others.
The malicious packages span five vendor namespaces: vsmov, vsphim, haiau009, chilltvcms, and ophimcms. Some packages are inactive but can be activated to run malicious JavaScript at any time. The attack’s origin is believed to be Vietnamese-based, likely operated by a group with links to the local region.
Impact, Security Implications, and Remediation Guidance
This threat can have serious consequences. If an iPhone is unpatched and visits a compromised site, personal data such as passwords, photos, contacts, and even cryptocurrency seeds can be stolen. The spyware is capable of exfiltrating sensitive information and potentially leading to financial theft. Additionally, the malware can redirect users to gambling and adult content sites, increasing the risk of exposure to further malware or scams.
The security implications are significant. Site operators unknowingly serve trojanized themes that infect visitors’ devices. This means both users and website operators are at risk. Users may lose private data or have their finances stolen. Website owners might face reputational damage or legal issues.
To reduce these threats, site operators should verify if they installed any malicious packages. They should remove all suspect packages, rotate security credentials, and audit their scripts for signs of compromise. It is important to update all software components, especially jQuery and theme scripts. If you suspect infection, obtain specific remediation guidance from the relevant vendor or official cybersecurity authorities.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
