Full Report
Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites that install those libraries and initiate the deployment of spyware aimed at unpatched iOS devices. "The injected code runs two operations against a site's visitors: a mobile ad-fraud and gambling-redirect
Analysis Summary
# Tool/Technique: Funnull-Linked iOS Spyware Campaign
## Overview
This technique involves a supply chain attack leveraging malicious PHP Composer packages (Packagist) to compromise Vietnamese streaming and comic websites. Once these malicious themes are installed, they inject JavaScript into the front-end to deliver a multi-stage iOS exploit chain. The ultimate purpose is the exfiltration of sensitive user data and cryptocurrency wallet seeds from unpatched iPhone devices, alongside secondary monetization through ad-fraud and gambling redirects.
## Technical Details
- **Type:** Malware family (Spyware / Info-stealer) / Supply Chain Technique
- **Platform:** iOS (Specifically versions 18.4 through 18.6.x); targets iPhone XS through iPhone 16.
- **Capabilities:** WebKit exploitation, kernel privilege escalation, data exfiltration, cryptocurrency wallet seed theft.
- **First Seen:** March 2026 (Initial campaign); August 12, 2026 (Redeployed version).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1195.002 - Supply Chain Compromise: Compromise Software Dependencies
- **TA0002 - Execution**
- T1203 - Exploitation for Client Execution
- T1059.007 - Command and Scripting Interpreter: JavaScript
- **TA0004 - Privilege Escalation**
- T1068 - Exploitation for Privilege Escalation
- **TA0006 - Credential Access**
- T1555 - Credentials from Password Stores
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- **TA0010 - Exfiltration**
- T1048 - Exfiltration Over Alternative Protocol
## Functionality
### Core Capabilities
- **Supply Chain Injection:** Delivery via 13 trojanized Composer theme packages (e.g., OphimCMS themes).
- **Environment Fingerprinting:** Injects a hidden iframe to detect the visitor's OS and iOS version to serve specific exploits.
- **Multi-Stage Exploitation:**
- **WebKit Exploits:** Leverages CVE-2025-31277 and CVE-2025-43529 to escape the Safari sandbox.
- **Kernel Escape:** Exploits `AppleM2ScalerCSCDriver` via IOKit to gain kernel read/write privileges.
- **Comprehensive Data Theft:** Collects Keychain databases, SMS, Photos, contacts, browser cookies, location history, and Wi-Fi passwords.
### Advanced Features
- **Crypto-Wallet Seed Stealer:** Specifically queries the iOS Keychain for mnemonic seeds and private keys associated with Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX.
- **Infrastructure Obfuscation:** Uses a rotating pool of C2 domains and beaconing status to `cloudfareintcdn[.]com`.
- **Monetization Diversification:** Includes a parallel ad-fraud and gambling-redirect chain for non-target (non-iOS) visitors.
## Indicators of Compromise
- **File Names (Malicious Packagist Namespaces):**
- `vsmov/theme-dy`, `vsmov/theme-rrdyw`, `vsmov/theme-motchill`, `vsmov/theme-vsmov`
- `vsphim/theme-heovl`, `vsphim/theme-thempho`
- `haiau009/kkphim-legend`, `haiau009/kkphim-motchill`
- `chilltvcms/theme-legend`
- `ophimcms/theme-dy`, `ophimcms/theme-motchill`, `ophimcms/theme-pcc`, `ophimcms/theme-rrdyw`
- **Network Indicators:**
- `cloudfareintcdn[.]com` (Beaconing/Status)
- Funnull-hosted infrastructure (Exploit hosting)
- `https://[C2_domain]/upload` (Exfiltration endpoint)
- **Behavioral Indicators:**
- Unexpected outbound HTTPS POST traffic to unknown domains from mobile Safari sessions.
- Presence of hidden `<iframe>` elements on CMS-driven movie/comic sites.
## Associated Threat Actors
- **Funnull:** A sanctioned entity (sanctioned May 2025) known for facilitating romance scams and crypto-fraud.
- **Unidentified Vietnamese-operated group:** Inferred from commit metadata timestamps and target site demographics.
## Detection Methods
- **Signature-based detection:** Scanning PHP dependencies for known malicious vendor namespaces listed above.
- **Behavioral detection:** Monitoring for unauthorized access to the `AppleM2ScalerCSCDriver` or unusual IOKit calls on iOS devices.
- **Web Analysis:** Checking for injected JavaScript that fingerprints the user-agent and dynamically loads external iframes.
## Mitigation Strategies
- **Patch Management:** Update iOS devices to version 18.7.3 / 26.2 or later to patch the underlying WebKit and kernel vulnerabilities.
- **Dependency Auditing:** Use tools like `composer audit` or Socket to identify and block known malicious packages in web development environments.
- **Content Security Policy (CSP):** Implement strict CSPs on web servers to prevent the execution of unauthorized external JavaScript and the loading of unauthorized iframes.
## Related Tools/Techniques
- **DarkSword:** An iOS exploit kit that uses a similar multi-flaw chain.
- **Watering Hole Attacks:** The broader technique of compromising niche sites to target specific user demographics.