As reported by The Hacker News, researchers at Socket have uncovered 13 malicious Packagist packages that weaponize Vietnamese streaming sites as delivery infrastructure for a full iOS exploit chain — one that escalates from browser sandbox to kernel and culminates in data exfiltration and cryptocurrency wallet theft. This is not a routine supply chain incident; it is a convergence of two attack surfaces that defenders rarely manage together.
The campaign demonstrates a troubling maturity in threat actor tradecraft. Rather than choosing between a web compromise and a mobile exploit, the operators chained them: PHP dependency poisoning at the CMS layer, JavaScript injection at the visitor layer, and a browser-to-kernel privilege escalation at the endpoint layer. The result is a pipeline where a site administrator installing a theme package unknowingly turns their entire visitor base into a spyware distribution channel.
Vulnerability Details
| CVE | Affected Component | Patched In | Severity | Exploited in the Wild |
|---|---|---|---|---|
| CVE-2025-31277 | WebKit (Safari / WebContent) | iOS 18.6 | High | Yes |
| CVE-2025-43529 | WebKit (Safari / WebContent) | iOS 18.7.3 and 26.2 | High | Yes |
| Kernel escape (AppleM2ScalerCSCDriver IOKit) | iOS / macOS Kernel | iOS and macOS 26.1 | Critical | Yes |
The exploit chain specifically targets devices running iOS 18.4 through 18.6.x — a window where the WebKit flaws remain unpatched but the kernel escape is still viable. The threat actors redeployed the chain around August 12, 2026, with an updated payload, indicating active development and refinement.
Why This Matters Beyond iOS Users
- PHP/Composer ecosystem exposure: Packagist remains a primary dependency source for countless PHP applications. The 13 packages span five vendor namespaces, showing how trivially attackers can flood niche theme markets with lookalike packages. Organizations running PHP CMS platforms — particularly regional or community-maintained ones — face persistent risk from unvetted dependencies.
- Web-to-mobile bridge attacks: Traditional web security and mobile security are managed by separate teams in most enterprises. This campaign exploits that organizational gap: a web team approves a theme package, and a mobile user bears the consequences. Defenders need cross-domain threat models.
- Crypto wallet targeting as a strategic objective: The payload specifically harvests keychain databases and wallet seed material. This signals continued attacker investment in mobile crypto theft infrastructure, which often flies under enterprise detection radar.
Who Is at Risk
Primary exposure falls on users running iOS 18.4 through 18.6.x who visit affected Vietnamese streaming sites. However, the broader risk extends to any organization whose PHP applications pull dependencies from Packagist without integrity verification. The package names identified — across the vsmov, vsphim, haiau009, chilltvcms, and ophimcms vendor namespaces — should be treated as indicators of compromise within any Composer lockfile.
Immediate Actions
- Update iOS devices immediately to version 18.7.3 or later (or 26.2 where available). Any device still on 18.6.x or earlier should be considered exposed to known weaponized exploits.
- Audit Composer lockfiles across all PHP projects for the 13 identified package names. Remove and replace any matches with verified alternatives.
- Implement dependency provenance checks using tools like Socket, composer-audit, or private Packagist mirrors with allowlisting. Block packages from unverified vendor namespaces.
- Deploy network-level detection for the reported C2 infrastructure, including beaconing to
cloudfareintcdn[.]comand HTTPS POST traffic to rotating C2 domains following the/uploadpattern. - Isolate and forensically examine any iOS device that accessed affected streaming sites between March 2026 and present. Keychain and wallet data should be considered potentially compromised.
Shield53 Recommendations
The most dangerous aspect of this campaign is not any single vulnerability — it is the operational discipline required to chain CMS supply chain compromise, browser sandbox escape, kernel exploitation, and structured data exfiltration into a single automated pipeline. Defenders must stop treating web and mobile security as separate disciplines.
- Establish a dependency governance policy that requires review and approval for any new Composer, npm, or pip package before it enters a production codebase. Require maintainer reputation analysis and download history review.
- Mandate iOS patch SLAs of 72 hours or less for critical Apple security releases. The gap between patch availability and device update remains the single largest exploitable window in mobile environments.
- Deploy mobile threat defense solutions capable of detecting kernel-level anomalies and unauthorized data exfiltration on managed iOS devices.
- Conduct tabletop exercises that simulate web-to-mobile attack chains, forcing web, mobile, and SOC teams to coordinate response across traditional silos.
- For organizations in media, streaming, or content distribution: audit all third-party themes and plugins against known package repositories before deployment, and implement Subresource Integrity (SRI) on all externally loaded JavaScript.
