CampaignPublished 4 Mar 2026

Malicious Packagist Packages Disguised as Laravel Utilities Deploy Encrypted RAT

Source AlienVault OTX General

Description

A remote access trojan (RAT) has been discovered in multiple Packagist packages published by the threat actor nhattuanbl. The malicious packages, disguised as Laravel utilities, install an encrypted PHP RAT via Composer dependencies. The payload connects to a C2 server, sends system reconnaissance data, and awaits commands, granting full remote access to the host. The RAT uses obfuscation techniques to resist analysis and employs a self-launch mechanism. It communicates with the C2 server using encrypted JSON messages and supports various commands for system control and data exfiltration. The attack vector leverages dependency chains, with clean-looking packages pulling in malicious ones. Affected systems should be treated as compromised, with recommendations provided for mitigation and prevention.

Impact

This threat can have severe consequences for organizations relying on PHP and Laravel frameworks, particularly those using Composer and Packagist for dependency management. The RAT grants attackers full remote access to compromised hosts, enabling unauthorized data access, system manipulation, and lateral movement within networks. This can lead to data breaches, intellectual property theft, disruption of services, and potential deployment of additional malware. The stealthy nature of the attack, leveraging trusted package dependencies and obfuscation, complicates detection and response efforts. Organizations may face reputational damage, regulatory penalties, and financial losses due to compromised systems. The dependency-chain attack vector increases the risk of widespread infection across development environments and production systems that incorporate these packages, potentially affecting continuous integration and deployment pipelines.

Defensive guidance

1. Conduct rigorous auditing of all Composer dependencies, including transitive dependencies, to identify and remove any suspicious or unverified packages. 2. Employ automated tools that scan for known malicious package hashes and monitor for unusual package behavior or network connections. 3. Implement strict policies to restrict the use of third-party packages to those from trusted sources and maintain an allowlist of approved packages. 4. Monitor outbound network traffic for connections to suspicious domains or IP addresses, particularly those matching known C2 infrastructure such as helper.leuleu.net. 5. Use runtime application self-protection (RASP) and endpoint detection and response (EDR) solutions to detect anomalous process behavior and persistence mechanisms. 6. Educate development teams about the risks of supply chain attacks and encourage the use of package integrity verification methods like Composer's hash verification and signature checks. 7. Regularly update and patch development tools and environments to reduce exposure to exploitation. 8. In case of compromise, treat affected systems as fully compromised: isolate, perform forensic analysis, remove malicious packages, and rebuild environments from known good sources. 9. Engage in threat intelligence sharing to stay informed about emerging malicious packages and indicators of compromise.

Indicators of compromise

Domains 1

helper.leuleu.net

URLs 1

http://helper.leuleu.net:2096

Hashes 1

a493ce9509c5180e997a04cab2006a48202afbb8edfa15149a4521067191ead7

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Mar 2026, 11:17 UTC

MITRE ATT&CK techniques8 from threat tags

Technical details

Indicators of compromise

Domains 1

URLs 1

Hashes 1

Community reviews

Related threats