Security researchers at Socket discovered several malicious Packagist packages masquerading as Laravel utilities. These packages deploy a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems.

Malicious Packages Identified

The threat actor, known as nhattuanbl, published several packages that deliver the payload:

• nhattuanbl/lara-helper: Contains the primary RAT payload in src/helper.php.
• nhattuanbl/simple-queue: Carries the identical RAT payload.
• nhattuanbl/lara-swagger: A “clean” package that lists lara-helper as a dependency, triggering automatic installation of the RAT.

Technical Details

• Activation: The RAT activates during the application boot process via a service provider or during class autoloading.
• Capabilities: Attackers gain full remote shell access, allowing them to read/write arbitrary files, capture system profiles, and access sensitive environment variables like .env files and API keys.
• Stealth: The malware uses control flow obfuscation, randomized identifiers, and encoded domain names to evade static analysis.
• Deceptive Tactics: The author also published “clean” packages (nhattuanbl/lara-media, nhattuanbl/snooze) to build a false sense of credibility.

Recommendations for Developers

If you have interacted with these packages, take these steps immediately:

1. Remove the packages from your composer.json and run composer update.
2. Assume compromise of the host machine and any secrets (e.g., database credentials, cloud keys) accessed by the application.
3. Rotate all secrets and API keys.
4. Audit outbound traffic for connections to the identified C2 server at helper[.]leuleu[.]net:2096