A newly uncovered campaign shows that a simple visit to a streaming website can be enough to hand over the contents of an iPhone. Malicious website themes infect outdated iPhones with spyware through tampered CMS packages, giving attackers access to private messages, photos, passwords, location data, and cryptocurrency wallet recovery phrases. Security researchers at Socket identified the threat on Packagist in the form of themes for OphimCMS and KKPhim, two Laravel-based content management systems widely used by Vietnamese movie and comic streaming platforms.
Malicious Website Themes Infect Outdated iPhones with Spyware
Malicious website themes infect outdated iPhones with spyware by embedding modified JavaScript inside legitimate-looking CMS packages. When a visitor loads a site that is running an infected theme, the JavaScript checks the device and iOS version. If the device meets the attack criteria, it loads a remote exploit and begins the infection process. No app download or phishing link is required.
The attack begins silently. The injected code first verifies that the visitor is using a targeted iPhone, rather than attempting to exploit every mobile device that passes through the site. On an iPhone running a vulnerable iOS version, the script launches a multi-stage exploit chain that first compromises Apple’s WebKit browser engine, then escapes the browser sandbox, and finally gains deeper access to the operating system. The final stage installs a spyware payload designed to collect sensitive data from the phone.
The campaign specifically targets iPhones from the iPhone XS through the iPhone 16 family running vulnerable iOS 18 releases, particularly iOS 18.4 through 18.6.x. That scope suggests the attackers built the exploit around specific patch levels. It is not a broad attempt to break every iPhone; it is a surgical campaign that uses known flaws to reach devices that have not been updated.
The Exploit Chain: WebKit, Sandbox, and Kernel
The chain depends on weaknesses in multiple layers of iOS. Two WebKit vulnerabilities used as entry points are already publicly known and have been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. Apple previously acknowledged that one of them, CVE-2025-43529, had been exploited in targeted attacks. That acknowledgment is significant because it means this vulnerability class was already being used in the wild before the full campaign was mapped.
The kernel-level weakness that appears later in the chain has a different status. Apple confirmed that this flaw had already been fixed before Socket reported it. That narrows the attack window but does not eliminate it. Any user running an iOS version predating that fix remains vulnerable. The broader point is that the entire chain relies on a specific, and increasingly narrow, set of software versions. Updates break the chain completely.
Packagist and the Supply Chain Problem
The malicious themes were not distributed through a dark web market or an unauthorized download site. They were published on Packagist, the package repository that most PHP developers use on a daily basis. That is what makes this campaign dangerous: the code arrives through a channel that administrators are trained to trust.
What Is Packagist and Why Does It Matter Here?
Packagist is the default package repository for Composer, the dependency manager used by PHP projects. It hosts libraries, plugins, and CMS themes that developers install with simple commands. Because packages from Packagist are widely treated as trustworthy, a malicious package can spread quietly across many websites before any alarm is raised.
What Are Malicious Website Themes?
A malicious website theme is a design package that looks legitimate but contains hidden code. In this campaign, the themes were created for OphimCMS and KKPhim, two Laravel-based content management systems used by Vietnamese movie and comic streaming sites. When site administrators install one of these themes, the malicious JavaScript becomes part of the site’s public pages and is served to every visitor.
Five Vendor Accounts and 13 Confirmed Malicious Packages
Socket identified 13 confirmed malicious packages across five Packagist vendor accounts. The packages were published under the namespaces vsmov, vsphim, haiau009, chilltvcms, and ophimcms. Some of these names are designed to look like legitimate parts of the CMS ecosystem, making manual review more difficult.
The danger extends beyond these 13 packages. Socket recommends treating any other packages from those publishers as untrusted because some of the package authors share the same operators and mechanisms used to activate malicious JavaScript later. For a website owner, that means a small mistake in package selection can turn a streaming site into an infection vector for visitors. For visitors, the risk is invisible: the site looks normal, and the attack does not require clicking anything.
What the Spyware Can Steal From an Infected iPhone
Once the exploit chain runs, the spyware payload can begin collecting a broad range of data. The list includes SMS messages, contacts, Wi-Fi passwords, photos, browser cookies, call records, location history, account information, notes, calendars, and data stored in the iOS Keychain.
Wi-Fi passwords and Keychain data are particularly dangerous because they unlock more than the phone itself. A stolen Wi-Fi password can provide access to a home network. Stored credentials and tokens from the Keychain can be used to reach email, banking, and corporate accounts. The practical impact of this spyware goes far beyond reading messages.
Crypto Wallet Recovery Phrases Become a Target
In August 2026, the campaign escalated. Socket observed a newly deployed version of the spyware capable of searching the iOS Keychain for cryptocurrency wallet secrets. The malware was found to specifically target recovery phrases and other wallet data associated with widely used apps, including Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX.
A cryptocurrency recovery phrase is effectively the master key to a wallet. Anyone who obtains it can restore the wallet and transfer funds without the owner’s permission. By adding this capability, the attackers have turned a general-purpose spying operation into a direct financial theft tool. The shift also explains why the campaign infrastructure is connected to fraud networks focused on cryptocurrency.
The Infrastructure Backbone Linked to FUNNULL
Socket linked the infrastructure serving the iOS exploit chain to FUNNULL, an infrastructure provider sanctioned by the US Treasury Department in May 2025. The sanctions were imposed for facilitating cryptocurrency investment scams blamed for more than $200 million in losses. This connection indicates that the malicious theme campaign is not an isolated operation but part of a larger financial crime ecosystem.
The same malicious themes also show a fallback revenue model. When the iOS spyware chain does not execute, the themes can target mobile visitors with gambling redirects and advertising fraud. That means even visitors on devices that are not vulnerable to the exploit can still be monetized. The operators are not dependent on one technique.
Update Levels Are the Decisive Defense
For users, the technical complexity of the exploit chain strongly reinforces an old rule: install Apple’s latest updates. Socket confirmed that the known exploit chain does not work against devices updated to iOS 26.2 or later. Users who remain on the iOS 18 branch should install at least iOS 18.7.3. These updates close the specific WebKit and kernel holes that the campaign exploits.
The targeting of iOS 18.4 through 18.6.x makes sense only if a meaningful number of users ignore updates. Once an update is released, the period of exposure is often defined by user behavior rather than vendor response. The campaign works because some iPhones are still running outdated iOS versions, even after Apple has shipped fixes. That is why “outdated” in this context refers to software status, not just phone age.
Which iPhones Are at Risk?
iPhones from the iPhone XS through the iPhone 16 family are at risk if they run vulnerable iOS 18 releases, especially versions between iOS 18.4 and iOS 18.6.x. Devices updated to iOS 26.2 or later are not vulnerable to the known exploit chain. Users on the iOS 18 branch should update to at least iOS 18.7.3.
What Website Administrators Should Do Now
Website administrators using OphimCMS or KKPhim should remove themes distributed by the five affected Packagist vendors and review their sites for injected JavaScript. The review should not be limited to the visible files in a theme folder. Malicious code can be embedded in template files, PHP controllers, or autoload routines, and it may only activate under specific device conditions.
Administrators should also audit all other packages from the affected vendor accounts and watch for suspicious external requests in server logs. Because the same operators control multiple accounts, future packages could be used to redeploy the same exploit chain. Removing only the 13 known packages may not be enough if other packages from the same publishers are still installed.
The campaign is a clear demonstration that website themes are no longer just visual assets. They are code, and code carries risk. Malicious website themes infect outdated iPhones with spyware through a trusted distribution channel, and they do so in ways that most visitors will never see. For users, the defense is simple but essential: update immediately and avoid letting iOS software fall behind. For developers and website owners, the lesson is broader: package ecosystems need continuous auditing, because a single malicious update can convert a popular streaming site into a silent surveillance platform.
