News Summary

• 13 malicious Composer theme packages on Packagist are designed to inject JavaScript into Vietnamese movie and comic streaming sites.
• The injected code runs two operations against a site's visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to- kernel exploit chain that installs spyware.
• It's not clear who is behind the campaign, although it's believed to be the work of a Vietnamese-operated group based on commit metadata timestamps.