Affected Systems

Packagist/Composer ecosystem: 13 malicious theme packages across 5 vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms). Targets Vietnamese streaming sites using OphimCMS/KKPhim. Exploits unpatched iOS devices (iPhone XS through iPhone 16) running iOS 18.4 through 18.6.x via CVE-2025-31277 and CVE-2025-43529. Kernel escape via unpatched iOS/macOS versions prior to 26.1.

Exploitation Status

Active exploitation confirmed. Malicious packages deployed on Packagist since March 2026, with iOS exploit chain redeployed August 12, 2026. Exploits weaponize known WebKit vulnerabilities (CVE-2025-31277, CVE-2025-43529) and suspected kernel escape bug (CVE-2025-43398, CVE-2025-43510, or CVE-2025-43520). Infrastructure linked to Funnull, a sanctioned entity.

Business Impact

Vietnamese streaming sites unknowingly distributed spyware to mobile visitors. iOS users on unpatched devices (18.4–18.6.x) face full device compromise: keychain exfiltration (crypto wallet seeds for Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, OKX), SMS, photos, contacts, Wi-Fi passwords, browser cookies, location history, and call logs. All mobile visitors subjected to ad-fraud and gambling redirects. Site operators are victims; their users' trust and data compromised. Supply chain attack via trusted package repository.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all Composer dependencies for the 13 malicious packages: vsmov/theme-dy, vsmov/theme-rrdyw, vsmov/theme-motchill, vsmov/theme-vsmov, vsphim/theme-heovl, vsphim/theme-thempho, haiau009/kkphim-legend, haiau009/kkphim-motchill, chilltvcms/theme-legend, ophimcms/theme-dy, ophimcms/theme-motchill, ophimcms/theme-pcc, ophimcms/theme-rrdyw. Remove immediately if found.
  • Inspect all OphimCMS and KKPhim theme installations for injected JavaScript in 'Custom JS' fields and review jQuery/theme scripts for connections to cloudfareintcdn[.]com or Funnull infrastructure.
  • Rotate all credentials and API keys for affected sites; assume compromise if malicious packages were installed.
  • Update all iOS devices to version 18.7.3 or later (or macOS 26.2+) to patch CVE-2025-31277, CVE-2025-43529, and kernel escape vulnerabilities.
  • Notify users of affected streaming sites to update iOS devices, change passwords, and monitor cryptocurrency wallets for unauthorized transactions.

---

# Geopolitical Context

Geopolitical Context

This supply chain compromise represents a financially motivated campaign targeting Vietnamese-language entertainment platforms, leveraging open-source package repositories to deploy sophisticated mobile exploits. The operation appears consistent with the evolving threat landscape in Southeast Asia, where cybercriminal infrastructure increasingly overlaps with state-adjacent or sanction-evading networks. The use of Funnull infrastructure—an entity sanctioned by the U.S. Treasury in May 2025 for enabling romance-baiting scams resulting in over $200 million in cryptocurrency losses—suggests potential linkages to organized cybercrime ecosystems operating in the region. While attribution remains unclear, commit metadata and targeting patterns point to Vietnamese-speaking operators. The campaign's technical sophistication, including kernel-level iOS exploitation and multi-stage payload delivery, indicates access to advanced tooling and exploit development capabilities that may be shared across criminal or grey-market networks in the Asia-Pacific region.

State Actor Alignment

No direct state actor attribution is evident from available data. However, the campaign's reliance on Funnull infrastructure is notable given U.S. Treasury sanctions imposed in May 2025 against the entity for facilitating cryptocurrency fraud schemes. This suggests the operators may be leveraging sanction-evading or sanction-adjacent infrastructure, potentially indicating ties to organized cybercrime networks that operate with varying degrees of state tolerance in Southeast Asia. The targeting of Vietnamese-language platforms and commit metadata timestamps are consistent with Vietnamese-speaking threat actors, though whether these represent independent criminal groups, state-tolerated operations, or purely financial actors remains unclear. The absence of geopolitical targeting or espionage indicators suggests a primarily financially motivated operation rather than state-directed activity.

Business Impacty pro region

The campaign's primary impact is concentrated in Vietnam and Vietnamese diaspora communities that consume localized streaming content. However, the broader implications extend to the integrity of open-source software supply chains globally, particularly for content management systems serving non-English language markets that may have less security scrutiny. The exploitation of unpatched iOS devices (versions 18.4 through 18.6.x, affecting iPhone XS through iPhone 16) highlights persistent patching gaps in mobile ecosystems, even for widely deployed consumer devices. For the Asia-Pacific region, the incident underscores the growing sophistication of financially motivated threat actors operating from or targeting Southeast Asian markets, particularly in cryptocurrency theft operations. The use of U.S.-sanctioned infrastructure may complicate international law enforcement coordination and financial remediation efforts for victims. European and North American users of Vietnamese-language content platforms may also be affected, extending the geographic footprint beyond the immediate region.

Forecast

If Vietnamese streaming platform operators do not audit and remove the identified malicious Composer packages, visitor exploitation is likely to continue, particularly targeting users on unpatched iOS devices below version 18.7. The threat actors' demonstrated ability to redeploy exploit chains—as evidenced by the August 2026 refresh adding cryptocurrency wallet stealers—suggests they will likely adapt to future iOS patches and expand targeting to additional wallet applications. If U.S. sanctions enforcement against Funnull infrastructure intensifies, the operators may migrate to alternative hosting providers, potentially causing temporary operational disruption but unlikely to halt the campaign entirely. The publication of technical indicators of compromise may prompt short-term infrastructure rotation, though the underlying supply chain compromise vector—trojanized open-source packages—remains viable if repository maintainers do not implement enhanced vetting procedures. If similar campaigns targeting non-English language CMS ecosystems proliferate, regional software supply chain integrity may degrade further, particularly in markets with limited security resources. Apple's patching of the underlying vulnerabilities in iOS 18.7.3 and 26.2 will reduce the attack surface over time, though adoption rates in price-sensitive Southeast Asian markets may lag, sustaining a viable victim pool for months.