Loading story…
Thirteen trojanized Composer theme packages for the OphimCMS and KKPhim streaming-site ecosystems injected malicious JavaScript into every visitor page, sending users to gambling and ad-fraud content and selectively attacking externally referred, non-desktop visitors. On vulnerable iPhones, the packages delivered a FUNNULL-hosted WebKit-to-kernel exploit chain targeting CVE-2025-31277, CVE-2025-43529, and an AppleM2ScalerCSCDriver kernel primitive; the campaign targeted iOS 18.4 through 18.6.x rather than updated versions.
The spyware harvested keychain data, messages, photos, browser cookies, location history, and cryptocurrency wallet seed phrases, then exfiltrated them to rotating command-and-control infrastructure. Operators redeployed the exploit chain and added wallet theft capabilities, while FUNNULL-linked infrastructure has continued operating after sanctions, with activity reportedly being separated from the FUNNULL CDN brand.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
The operators rotated the second-stage loader for the iOS exploitation chain again.
Operators redeployed the complete FUNNULL-hosted iOS exploit chain under new filenames. The redeployed spyware added keychain queries targeting wallet data associated with Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX.
OFAC sanctioned Liu Lizhi for facilitating more than $200 million in cryptocurrency scams. The report links FUNNULL infrastructure to systems administered by Liu Lizhi.
Attackers distributed 13 trojanized Composer/Packagist website-theme packages across five namespaces, causing Vietnamese movie and comic streaming sites to serve malicious JavaScript to visitors. The loaders selectively targeted qualifying iPhone users for the FUNNULL-hosted iOS exploit chain while redirecting other mobile traffic to gambling content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 57 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcecyberveille.ch
Open sourcesocket.dev
Open sourcesilentpush.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported two separate npm supply-chain compromises that delivered malware and exploit infrastructure to downstream users. One analysis uncovered an obfuscated Node.js stealer designed to run across **Windows via WSL, macOS, and Linux**, with plaintext modules for browser credential theft, recursive exfiltration of sensitive files, and a **WebSocket-based reverse shell**. The malware targeted Chromium-based browsers and cryptocurrency wallet extensions, sent browser data, files, and command traffic to `216.126.225.243` over ports `8085`, `8086`, and `8087`, and included host profiling plus an `HMAC-SHA256` routine with a hardcoded key. Researchers noted the command-and-control IP had previously been associated with **DPRK-linked OtterCookie** infrastructure. In a separate incident, Socket Threat Research said the widely used npm package **`art-template`** was compromised after repository control was transferred to an unknown actor, who inserted malicious remote-script loaders into versions **`4.13.5`** and **`4.13.6`**. The injected code redirected users to a watering-hole framework at `utaq.cfww.shop` that selectively targeted **Safari on iOS 11.0 through 17.2**, beaconed device and IP data to `l1ewsu3yjkqeroy.xyz`, and used anti-bot checks, anti-headless logic, and **WebAssembly-based fingerprinting** before retrieving gated payloads. Researchers found strong overlap with the **Coruna exploit kit**, including version-aware targeting, XOR obfuscation, architecture-specific dispatch, and a cutoff at **iOS 17.3**, with additional similarities noted to **UNC6691**.
Jun 29, 2026
Google-owned Mandiant disclosed infrastructure tied to **Coruna**, an iOS exploit kit delivered through a large network of disposable domains and subdomains. The identified URLs used both HTTP and HTTPS and followed recurring path patterns such as `/group.html`, `/tuiliu/group.html`, `/static/analytics.html`, and `/88k4ez/group.html`, indicating coordinated staging, traffic routing, or payload delivery across the operation. The delivery network included cryptocurrency-themed, gaming-themed, app-store-themed, and typo-squatted domains designed to imitate legitimate brands or attract victims with lures related to digital assets and mobile apps. The breadth and branding of the infrastructure suggest a flexible campaign architecture built to rotate domains quickly, mask exploit delivery, and support continued distribution of the Coruna iOS exploit kit.
Jul 12, 2026
Hungary's National Cybersecurity Institute warned that **DarkSword**, a publicly available spyware and exploit kit for Apple devices, is targeting iPhones and iPads running `iOS 18.4` through `18.7` and corresponding `iPadOS` versions. The malware was described as easy to deploy after its code was released on a popular code-sharing platform, lowering the barrier for cyber-espionage activity. Once executed, DarkSword can steal contacts, messages, call history, authentication-related data, and other sensitive information, then exfiltrate it to attacker-controlled servers before deleting itself from the device to hinder detection. New reporting says the operation has since grown into a broad malicious web infrastructure spanning **180 web properties and 27 hosts**, using fake Apple sign-in pages, Apple-themed lures, and compromised websites to deliver a leaked six-vulnerability exploit chain and **GHOSTBLADE** data-theft modules. Researchers said successful compromise can expose keychain contents, iCloud data, Wi-Fi credentials, files, and Apple ID credentials, while operators rotate servers quickly and remove artifacts such as crash reports and `RemoteLog.log` to frustrate forensic analysis. Defenders were urged to apply Apple security updates, enable **Lockdown Mode** where patching is delayed, and monitor for recurring infrastructure fingerprints tied to the campaign.
Aug 4, 2026