Visiting a Vietnamese streaming site — without clicking a link or downloading a file — can silently drain a crypto wallet. Socket’s Threat Research Team identified 13 malicious Composer/Packagist theme packages, spread across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms), injecting JavaScript into streaming sites built on OphimCMS and KKPhim. The payload runs two attacks simultaneously: gambling redirects and ad injection for every mobile visitor, and a full WebKit-to-kernel exploit chain targeting iPhones on iOS 18.4 through 18.6.x.
How a Movie Site Empties Your Wallet
The attack requires nothing from you — just a page load on an unpatched iPhone.
Buried in legitimate-looking theme code, the injected script drops a hidden iframe, detects the visitor’s iOS version, and loads a version-specific exploit payload. Think of it like a burglar who checks the lock model before choosing the right pick. The chain weaponizes two public WebKit vulnerabilities — CVE-2025-31277 (patched in iOS 18.6) and CVE-2025-43529 (patched in iOS 18.7.3 and 26.2) — to escape Safari’s sandbox, pivot through the GPU process, and reach the kernel via the AppleM2ScalerCSCDriver IOKit user client. The result is full kernel read/write access. Socket’s researcher Kush Pandya compares the structure to the DarkSword exploit kit.
Once inside, the spyware takes everything:
- iOS Keychain databases, including crypto wallet seeds and mnemonics
- Wi-Fi passwords, SMS messages, contacts, and photos
- Browser cookies, call history, location history, and account databases
- Wallet-specific targeting: Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX
- All data AES-encrypted and exfiltrated via HTTPS POST to rotating C2 domains; exploitation progress beaconed to cloudfareintcdn[.]com
Around August 12, 2026, the threat actors redeployed the full iOS chain with a new payload adding that targeted crypto-wallet seed stealer — moving the campaign from broad surveillance app into direct financial theft.
“A mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit [exploit chain].” — Socket’s Kush Pandya
This campaign has history. Pandya flagged six similar malicious OphimCMS packages back in March 2026, shipping trojanized jQuery for ad injection and gambling redirects. The infrastructure serving these exploits runs through Funnull — a provider previously sanctioned by the U.S. Treasury for facilitating over $200 million in crypto romance-scam losses and linked to the Polyfill.io supply-chain compromise.
Sanctions didn’t slow anyone down here.
What You Should Do Right Now
The fix for iPhone users is immediate; the risk for site operators runs deeper.
If your iPhone runs anything below iOS 18.7.3, update now. That closes both WebKit CVEs and the kernel escape used in this chain. Users on the iOS 26 line should be on 26.2 or later. If you visited Vietnamese streaming sites on a vulnerable device — and any of the targeted wallets are installed — move your funds and regenerate seeds on a clean, uncompromised device. Don’t wait for confirmation.
Socket also flagged dormant packages across the same five namespaces, currently carrying no active payload but configurable to go live via “Custom JS” fields that render on every page — no new theme release required. Operators running OphimCMS or KKPhim should:
- Audit installed Composer themes against the malicious namespaces
- Remove any matches immediately
- Rotate exposed credentials
- Monitor traffic for connections to known Funnull-linked domains
The server-side attack surface stays open until every affected package is gone.
Supply-chain risk isn’t abstract — it shows up as a zero Trust Wallet balance. Your iOS update is the one fix entirely in your hands; knowing how to stay safe on mobile starts with acting right now.
