MITRE Techniques

• [T1195.001 ] Supply Chain Compromise: Compromise Software Dependencies and Development Tools – Malicious theme packages were published as trojanized Composer dependencies and installed by site operators (‘malicious Composer theme packages on Packagist’ / ‘A site operator installs a core package plus a theme with composer require’).
• [T1608.001 ] Stage Capabilities: Upload Malware – The theme packages shipped staged loaders, second-stage JavaScript, and the final spyware payload (‘It pulls a second stage from FUNNULL infrastructure’ / ‘the final payload uses the kernel read’).
• [T1608.004 ] Stage Capabilities: Drive-by Target – The injected code activated based on visitor platform and referrer, serving payloads to mobile visitors (‘loaders gate on platform and referrer so that mobile visitors are targeted’).
• [T1102 ] Web Service – The npm/Packagist-style hosted infrastructure and remote domains were used as a delivery and dead-drop mechanism (‘npm registry as a dead-drop resolver’ / ‘pulls a second stage from FUNNULL infrastructure’).
• [T1189 ] Drive-by Compromise – Visitors to compromised sites were automatically hit with malicious JavaScript and exploit stages (‘inject JavaScript into every page’ / ‘loading a page in mobile Safari’).
• [T1203 ] Exploitation for Client Execution – The browser-based WebKit chain achieved code execution in the client context (‘weaponizes two WebKit vulnerabilities’ / ‘builds arbitrary read and write inside the WebContent renderer’).
• [T1068 ] Exploitation for Privilege Escalation – The chain escaped the browser sandbox and reached the kernel through a driver interface (‘A second stage reaches the kernel’ / ‘The kernel escape was already addressed’).
• [T1027 ] Obfuscated Files or Information – Multiple payloads and loaders were disguised with renamed scripts, custom base64 decoding, and encoded PHP bytecode (‘custom base64 decoder’ / ‘ionCube-encrypted PHP bytecode’).
• [T1140 ] Deobfuscate/Decode Files or Information – The loader decoded a base64-encoded second-stage URL before inserting it as a script (‘the base64 argument decodes to union[.]macoms[.]la/jquery.min-3.6.8.js’).
• [T1480 ] Execution Guardrails – The malware checked user agent, platform, and referrer to restrict execution to intended targets (‘Gates on platform and referrer’ / ‘matches iPhone, iPod, Android, or iOS’).
• [T1497 ] Virtualization/Sandbox Evasion – The exploit chain used sandbox pivoting and non-desktop checks to bypass restricted environments (‘pivoting through a mediaplaybackd XPC service’ / ‘if … not Mac|Win … and … document.referrer’).
• [T1552.001 ] Unsecured Credentials: Credentials in Files – The spyware stole stored credentials and wallet material from the device and keychain (‘collect keychain databases, Wi-Fi passwords … wallet material’).
• [T1041 ] Exfiltration Over C2 Channel – Stolen data was encrypted and uploaded to command-and-control domains (‘uploads them over HTTPS POST /upload to a rotating pool of command and control domains’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – Exfiltration and beacons used HTTPS and web requests (‘beacons exploitation progress’ / ‘uploads them over HTTPS POST /upload’).