A batch of poisoned website themes is turning popular streaming portals into a trap for iPhone owners. Load one of these pages on an outdated handset and spyware can strip keychains, passwords and cryptocurrency wallets.
The registry poison is a cluster of thirteen Composer components across five publisher identities, dressed up as templates for the OphimCMS and KKPhim engines that run many Vietnamese film and manga portals, per security house Socket. Everyone landing on a compromised page from a phone is shunted through gambling and ad-fraud detours, researcher Kush Pandya noted, while iPhone users face a deeper attack.
For those handsets a hidden frame gauges the iOS build and serves an exploit built on two WebKit flaws, CVE-2025-31277 and CVE-2025-43529, an echo of the DarkSword kit. The climb starts with a sandbox breakout from the browser’s content renderer, hops through the graphics pipeline and finishes inside the AppleM2ScalerCSCDriver IOKit user client, which hands the spyware kernel-level read and write.
Apple had already sealed that weakness in iOS 26.1 and macOS 26.1 without publishing a CVE; Socket suspects a match with one of three kernel bugs fixed late last year. The spyware then sweeps keychain records, Wi-Fi passwords, SMS, contacts, photos, cookies, call history and location data, encrypts the haul and ships it to rotating command servers. An August 12 refresh aimed at iPhone XS through iPhone 16 units on iOS 18.4 to 18.6.x adds wallet-seed theft covering Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet and OKX.
Exploit hosting sits on Funnull, sanctioned by the U.S. in May over romance scams tied to over $200M in crypto losses; commit timestamps point to Vietnamese operators, Socket says. Streaming admins who unknowingly shipped the tainted themes should remove the packages, rotate credentials and audit bundled jQuery and theme code.
