13 malicious Packagist themes (vsmov, vsphim, haiau009, chilltvcms, ophimcms) inject JavaScript into Vietnamese streaming sites that serves a WebKit-to-kernel exploit chain to unpatched iPhone visitors. The chain uses CVE-2025-31277 and CVE-2025-43529 for initial execution, pivots through the GPU process, and escapes the sandbox via AppleM2ScalerCSCDriver to deploy spyware. The spyware exfiltrates keychain data, device databases, and cryptocurrency wallet seeds over HTTPS to FUNNULL infrastructure.
WebKit Exploit
1 post
13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds