THIRTEEN trojanised Composer packages used on Vietnamese streaming sites inject JavaScript into front-end assets to deliver Packagist themes iOS spyware to unpatched iPhones. The campaign targets visitors to Vietnamese movie and comic streaming sites, with site operators unknowingly installing the malicious themes via Composer. The outfits come from five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) and involve forked legitimate projects to look authentic.
Researchers from the Socket Threat Research Team describe the infection as delivering malicious JavaScript to every mobile visitor, while desktop users, bots, and direct visits largely pass through.
The infection chain splits mobile visitors into two branches. One branch presents a banner ad linking to a gambling-redirect sequence affecting both Android and iOS. The second branch targets iPhones: a loader reads the exact iOS version, fetches a matching WebKit exploit, and a two-stage chain weaponises public WebKit vulnerabilities to gain arbitrary read/write in the WebContent renderer. The payload then moves to the GPU process and finally Escapes to the device kernel via a specific IOKit user client.
This kernel escape is described as an n-day vulnerability, with Apple patching the flaw in iOS 26.1; the chain therefore targets iPhones not yet updated beyond iOS 18.6.x. Once kernel access is obtained, the spyware exfiltrates sensitive data, including keychain databases, Wi‑Fi passwords, messages, contacts, browser cookies, call history, locations, and photos.
In August 2026, operators updated the payload to actively query the iOS keychain for cryptocurrency wallet seeds tied to Bitget, Phantom, Trust Wallet and OKX, with stolen data encrypted via AES and uploaded to a rotating pool of twenty C2 domains. Security teams should audit Composer dependencies, remove malicious themes, and block exfiltration domains; Apple’s latest updates mitigate the known exploit stages.