Malicious Packages Disguised as Laravel Utilities Deploy PHP RAT and Enables Remote Access
A security incident has been identified involving a supply chain attack targeting the PHP developer community via Packagist, the official repository for PHP and Laravel packages.
A security incident has been identified involving a supply chain attack targeting the PHP developer community via Packagist, the official repository for PHP and Laravel packages.
The attack involved the publication of several packages by the threat actor nhattuanbl , disguised as legitimate Laravel utility libraries, which contained a remote access trojan (RAT). These packages provided attackers with silent and persistent control over systems that installed them.
The threat actor released six packages under the same author name between June and December 2024. Of these, three were clean, while nhattuanbl/lara-helper and nhattuanbl/simple-queue contained malicious code embedded in a file named src/helper.php . Additionally, nhattuanbl/lara-swagger indirectly included the malicious payload by setting a dependency on lara-helper .
Once installed, the payload connects to a command-and-control (C2) server at helper[.]leuleu[.]net on port 2096, transmitting system profiles and awaiting operator commands for remote control.
These packages provided attackers with silent and persistent control over systems that installed them.
The campaign impacts any Laravel application that installed these packages, allowing the RAT to access environment variables, database credentials, and API keys stored in .env files. The threat is cross-platform, affecting Windows, macOS, and Linux systems.
The RAT continues attempts to contact its C2 server every 15 seconds, retaining the potential for reactivation if redirected to a new host.
The helper.php file is obfuscated and uses various techniques for stealth, including control flow disruption and string encoding. The RAT activates differently based on the package, either through Laravel's auto-discovery mechanism or immediate execution upon autoload.
Once activated, the RAT runs as a background process, encrypted communication is facilitated using AES-128-CTR with a hardcoded key, and it executes commands received from the C2 server.
Consider any systems using nhattuanbl/lara-helper , nhattuanbl/simple-queue , or nhattuanbl/lara-swagger as compromised. Rotate all credentials accessible from the application environment. Remove the malicious packages and audit file permissions, particularly for chmod 0777 files. Delete the lock file at {sys_get_temp_dir}/wvIjjnDMRaomchPprDBzzVSpzh61RCar.lock . Review and monitor outbound network traffic to helper[.]leuleu[.]net:2096 and audit all dependencies. Avoid using dev-master constraints in production environments to ensure version integrity.
Based on reporting by Cyber Security News.