Site themes used by Vietnamese streaming platforms have been weaponized by hackers to harvest cryptocurrency wallet seeds and device data from iPhones through infected website templates. The attack leverages Composer—the tool commonly used to manage PHP components—to distribute harmful themes that invisibly inject malicious JavaScript into streaming sites without site owners realizing it. This lets malware reach every visitor once the theme is installed. The attack was discovered recently, impacting dozens of theme packages.
How the Scheme Works
The compromised themes retain all normal site files but add JavaScript loaders that scan user environment. They ignore desktop browsers, automated tools, and visitors arriving directly. But mobile users are rerouted to ad-heavy gambling sites, while certain iPhone users are exposed to far more dangerous exploits. These loaders check for iOS version and device specifics using known WebKit vulnerabilities.
If an iPhone meets the exploit criteria, another loader fetches stage-two code from attackers’ infrastructure, then proceeds to exploit the device using WebKit flaws (CVE-2025-31277 and CVE-2025-43529). If successful, the infection jumps from browser context deeper into the system.
The Fallout: Spyware and Crypto Theft
Once inside, the spyware harvests sensitive data including password vaults (keychain), Wi-Fi credentials, messages, contacts, photos, browser cookies, call history, location, and account details. Most alarmingly, it also extracts seed phrases and mnemonics linked to cryptocurrency wallets. With those, attackers can seize control of funds.
Devices updated to recent releases—specifically iOS 18.7.3 on the iOS 18 line, and iOS 26.2 or later—are safe from the known exploit chain. That shows how delayed updates play a major role in exposure. The malicious chain affected iPhones from the XS model up through the iPhone 16 series that hadn’t applied these updates.
Indicators & Mitigation Tips
The campaign has been tracked to at least 13 poisoned theme packages across five creator namespaces. Some of the malicious packages include “vsmov/theme-dy”, “vsphim/theme-heovl”, “chilltvcms/theme-legend”, among others.
Also identified were URLs and domains used in the redirect, distribution, and command-and-control process—such as union.macoms.la/jquery.min-3.6.8.jsfor loader delivery; domains like cdn.data-2920.comand cdn.data-2919.comfor exploit delivery; and multiple exfiltration hosts. File hashes and SHA-256 indicators were also documented to aid detection.
Webmasters using Composer should audit all installed themes, remove untrusted ones immediately, pin and review dependencies, and inspect network activity for unusual requests or hidden iframe behavior. Administrators need to prioritize applying the latest iOS updates to reduce risk. Blocking the identified domains and loaders is also advised.
This incident underscores how software supply-chain attacks now extend beyond developer tools into the very templates that shape user experiences. When frontend assets like themes are compromised, users—not just creators—bear the consequences. For anyone managing or visiting sites built with Composer, vigilance and rapid updates are more than best practice—they may be the only defense between your crypto and attackers.
