Socket: FUNNULL iOS Spyware Campaign via 13 Malicious Packagist Themes

What it is

Thirteen trojanized Composer theme packages on Packagist, published across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms), forked from the Laravel-based OphimCMS and KKPhim streaming CMSes. Installing one via composer require makes the site serve malicious JavaScript to every visitor. This expands Socket's March report (six ophimcms themes) to 13 confirmed packages and follows the chain to the iOS payload's latest redeployment. Full list: vsmov/theme-dy,theme-rrdyw,theme-motchill,theme-vsmov · vsphim/theme-heovl,theme-thempho · haiau009/kkphim-legend,kkphim-motchill · chilltvcms/theme-legend · ophimcms/theme-dy,theme-motchill,theme-pcc,theme-rrdyw.

How it works

The loader in the theme JS gates on platform and referrer, so desktop browsers, bots, and direct visits are skipped.

flowchart TD
  V[Site visitor] --> M{mobile UA?}
  M -- iPhone/iPod/Android/iOS --> AD[banner to 23.225.52.67:4466/vip344.html → .vip gambling, port 7740]
  M -- non-desktop + external referrer --> IOS[iOS WebKit-to-kernel chain]
  IOS --> R[WebContent renderer R/W via JSC corruption]
  R --> G[GPU-process pivot: IOSurface + mach, forged PAC pointers]
  G --> K[Kernel via AppleM2ScalerCSCDriver IOKit user client]

The iOS loader uses a custom base64 decoder (avoiding native atob) and decodes to union[.]macoms[.]la/jquery.min-3.6.8.js, which chains through cdn[.]data-2920[.]com/app.vue.js → www[.]cloudfareintcdn[.]com/in-static.js (Cloudflare-impersonating) → a hidden start-view.html iframe that reads the iOS version and serves a version-specific WebKit exploit. It carries per-build, per-chipset offset tables. The renderer stage is annotated in-code with CVE-2025-31277 (iOS 18.4–18.5) and CVE-2025-43529 (iOS 18.6+); both are public and in CISA's KEV. The kernel escape reaches AppleM2ScalerCSCDriver from a sandbox by pivoting through a mediaplaybackd XPC service. The renderer CVEs and staging overlap the publicly documented "DarkSword" iOS exploit kit.

Preconditions / Affected

• Site operators running OphimCMS/KKPhim who installed any of the 13 themes above.
• Visitors on iPhones running iOS 18.4 through 18.6.x, iPhone XS through iPhone 16 family, not yet updated. The gambling/ad-fraud branch hits any mobile visitor.

What to do

• Audit composer.json/composer.lock for the 13 packages and the five vendor namespaces; the upstream author handle remains in the forks, so these are hostile republishes, not the originals.
• Block/alert on IOCs: domains union[.]macoms[.]la, cdn[.]data-2920[.]com, www[.]cloudfareintcdn[.]com, im[.]ue8im[.]com; IPs 23[.]225[.]52[.]67:4466, 23[.]225[.]48[.]20:4466 (campaign id vip344).
• Ensure iOS/macOS devices are on 26.1 or later — Apple confirmed the kernel escape was already fixed there before disclosure.

Caveats

Apple states the kernel escape was fixed in iOS/macOS 26.1 before Socket's report, and acknowledges CVE-2025-43529 was exploited only in a targeted attack against specific individuals — so patched or updated devices are not exposed to the kernel stage. The page's payload excerpt cuts off at the IOKit external method call; deeper post-exploitation detail is not given.