Malicious Packagist Packages Deliver Cross-Platform PHP RAT via Fake Laravel Utilities (nhattuanbl Campaign) — Threadlinqs Intelligence
As of 2026-05-30, Malicious Packagist Packages Deliver Cross-Platform PHP RAT via Fake Laravel Utilities (nhattuanbl Campaign) is a high-severity supply chain threat attributed to nhattuanbl (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0217 · Severity: HIGH · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: nhattuanbl · N/A · UNKNOWN
Six Packagist packages published by threat actor nhattuanbl masquerade as Laravel utilities while deploying a cross-platform PHP RAT with full C2 capabilities including shell execution, screenshot
A sophisticated supply chain attack targeting the PHP/Composer ecosystem was discovered in March 2026, involving six packages published on Packagist by a threat actor operating under the handle nhattuanbl. The campaign employed a credibility-building strategy: three packages (lara-media, snooze, syslog) were completely clean and served to establish author legitimacy, while two packages (lara-helper and simple-queue) contained an identical malicious payload hidden in src/helper.php. A sixth package (lara-swagger) acted as a dependency-chain carrier, listing lara-helper as a hard Composer dependency so that installing it automatically pulled in the RAT.
The Packagist account was created in December 2015 but remained dormant until June 2024, when the threat actor began publishing packages over a six-month window ending in December 2024. The lara-helper package accumulated 37 installs, simple-queue had 29, and lara-swagger reached 49 downloads before discovery.
The malicious payload in src/helper.php is a fully-featured cross-platform remote access trojan (RAT) functional on Windows, macOS, and Linux. It employs multiple obfuscation techniques to complicate static analysis: control flow obfuscation, encoded domain names and command identifiers, and randomized variable and function naming. The RAT establishes a persistent TCP connection to the C2 server at helper.leuleu.net on port 2096 using PHP stream_socket_client(). If the connection drops, it automatically retries every 15 seconds indefinitely. The operator can redirect it to a new host without modifying the on-disk payload.
Before executing commands, the RAT probes the PHP environment for disabled_functions and selects the first available execution method from: popen, proc_open, exec, shell_exec, system, or passthru. The supported command set includes: ping (60-second heartbeat), info (system reconnaissance transmission), cmd (shell command execution), powershell (PowerShell command execution), run (background shell execution), screenshot (screen capture via imagegrabscreen()), download (file reading from disk), upload (file writing with universal read/write/execute permissions 0777), and stop (socket termination and exit).
Activation occurs at application boot via Laravel service provider registration or during class autoloads, meaning the RAT runs in the same PHP process as the web application with identical filesystem permissions and full access to environment variables including database credentials, API keys, and .env contents. This makes credential harvesting trivial without any additional exploitation.
The campaign was discovered and publicly disclosed on March 4, 2026 by Socket security researcher Kush Pandya. The packages were flagged as malware by Aikido security analysis on Packagist. At time of initial disclosure, the C2 server at helper.leuleu.net:2096 was not responding, though the RAT remains on disk and retries connections indefinitely. All versions of the three malicious packages are compromised with no safe iteration available.
Weaknesses (CWE)
CWE-506, CWE-829
Target sectors: technology, software-development, web-development, saas, e-commerce, enterprise
Target regions: Global
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1585, T1608, T1195, T1059, T1059, T1547, T1027, T1036, T1082, T1083