Cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3oredhatenterprise_linux_eus8.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 01 Sep 2026 15:09:46 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMalicious Packagist Composer Themes Deploying iOS Spywarehttps://feed.craftedsignal.io/briefs/2026-09-packagist-ios-spyware/Tue, 01 Sep 2026 15:09:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-packagist-ios-spyware/Threat actors are distributing 13 malicious Composer themes via Packagist to compromise streaming websites and deploy a WebKit-to-kernel exploit chain against iOS visitors for data exfiltration and cryptocurrency wallet theft.Researchers have identified 13 malicious Composer theme packages hosted on Packagist that target Vietnamese movie and comic streaming sites. These packages are part of a broader campaign involving at least five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject malicious JavaScript into websites. When a user visits an infected site on an unpatched iOS device (specifically iOS versions 18.4 through 18.6.x), the script triggers a multi-stage exploit chain. This campaign leverages infrastructure previously linked to the Funnull entity to facilitate browser-based exploitation. The final payload achieves kernel-level access on the target iPhone, enabling the exfiltration of sensitive databases, including SMS, browser cookies, Photos, and cryptocurrency wallet seeds from applications like Bitget, Phantom, and Trust Wallet. This threat is particularly notable for its use of supply chain compromise to reach end-users and the automation of financial theft via mobile browser exploitation.

Attack Chain

  1. Site administrators unknowingly install a trojanized Composer theme package from the Packagist repository.
  2. The theme injects malicious JavaScript into every page served to website visitors.
  3. The JavaScript performs browser-side environment fingerprinting to identify the visitor's iOS version.
  4. The script retrieves a platform-specific exploit payload hosted on external infrastructure (Funnull).
  5. The browser executes an exploit chain weaponizing CVE-2025-31277 and CVE-2025-43529 to escape the WebContent sandbox.
  6. The exploit pivots to the GPU process and triggers a kernel vulnerability (AppleM2ScalerCSCDriver) to gain read/write privileges.
  7. The final spyware payload extracts the iOS Keychain, SMS, Photos, and wallet seeds, then encrypts them using AES.
  8. The stolen data is exfiltrated via HTTPS POST to a rotating pool of command-and-control domains.

Impact

The campaign affects users of mobile Safari on iOS devices running vulnerable firmware (iOS 18.4 through 18.6.x). If successful, attackers gain complete access to the device's personal data, including Wi-Fi passwords, call history, location, and cryptocurrency assets. The use of infrastructure associated with previously sanctioned entities indicates a high-stakes financial motivation. While the exact number of victims is not publicly quantified, the campaign targets high-traffic streaming sites, suggesting a broad scope of potential compromise.

Recommendation

  1. Site operators using OphimCMS or KKPhim must audit dependencies for the identified vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) and remove all unauthorized themes immediately.
  2. Block the identified C2 domain "cloudfareintcdn.com" at the network perimeter and DNS resolver level.
  3. Enforce OS updates for all mobile devices; prioritize patching iOS to 18.7.3 or later and macOS to 26.1 or later to mitigate CVE-2025-31277 and CVE-2025-43529.
  4. Users should review permissions for cryptocurrency wallet applications and rotate credentials for affected accounts if their devices were running vulnerable iOS versions during the period of exposure.
]]>highadvisorysupply-chainmobile-malwareweb-securitycryptocurrency-theftiosspyware