Malicious Packagist Packages Chain WebKit Exploits to Kernel for iOS Crypto Theft

The packages across five namespaces delivered a Funnull-hosted chain that first ran mobile ad fraud and gambling redirects, then on iPhones inserted an iframe to fingerprint iOS version and load version-specific exploits. Execution escaped the WebContent sandbox into the GPU process before pivoting through AppleM2ScalerCSCDriver to achieve kernel read-write. Final payload exfiltrated keychain, SMS, photos, cookies, and wallet mnemonics over HTTPS to rotating C2 domains including cloudfareintcdn.com.

Socket documented the same five namespaces redeploying the full chain on 12 August 2026 with added iOS Keychain queries for crypto material. Commit timestamps and targeting of Vietnamese sites point to a local operator. Apple confirmed the kernel escape was already fixed in iOS 26.1 and macOS 26.1, likely one of three late-2025 kernel CVEs, though no identifier was shared.

This operation illustrates how supply-chain compromise of Composer packages enables rapid iteration of mobile exploits. The August payload update and rotating infrastructure show automation that outpaces signature-based detection. When attackers apply generative models to craft JS injects and C2 beacons, defenders relying on static analysis or delayed CVE patching face compressed response windows measured in days rather than months.

Next indicators will appear in new theme packages from the same namespaces or fresh Funnull-hosted domains. Monitoring Packagist for anomalous "Custom JS" fields and cross-referencing against known exploit-hosting IPs provides the earliest signal before widespread wallet drains resume.