Malicious Laravel Packages Deploy PHP RAT, Grant Remote Access to Attackers

Malicious Packagist packages masquerading as Laravel helper utilities are delivering an obfuscated PHP remote access trojan (RAT) that grants full remote control over compromised hosts.

Two of these, nhattuanbl/lara-helper and nhattuanbl/simple-queue, embed a byte‑for‑byte identical RAT payload in src/helper.php.

A third package, nhattuanbl/lara-swagger, appears benign but hard‑depends on lara-helper, ensuring the malware is installed transitively whenever developers require the swagger utility. The remaining three packages are currently assessed as clean, but help build trust around the author and naming scheme.​

Socket’s Threat Research Team linked the campaign to Packagist user nhattuanbl, who published six Laravel-themed packages within a short window between June and December 2024.

Once loaded, the payload establishes a raw TCP connection to a command‑and‑control (C2) server at helper[.]leuleu[.]net:2096, sends host reconnaissance data, and then waits for operator commands, effectively turning any affected Laravel host into a fully controlled remote shell.

Payload behavior and persistence

The malicious helper.php script is heavily obfuscated and delivered as a single 27 KB line after the opening PHP tag, with randomized labels and identifiers, hex/octal‑encoded strings, and extensive goto‑based control flow to frustrate static analysis.

In lara-helper, the RAT is pulled in via Laravel’s service provider auto‑discovery: the provider’s register() method unconditionally includes helper.php on every application boot.

In simple-queue, an include_once at file scope ensures the payload executes as soon as the autoloader resolves the nhattuanbl\SimpleQueue class, even if the class is never instantiated.​

To maintain stealthy persistence, the script immediately re-launches itself as a detached background PHP process whenever it is first included without CLI arguments, passing a helper argument to enter the main RAT loop and then returning control to the application.

A lock file in the system temporary directory prevents multiple concurrent instances and expires after 15 minutes, while the RAT continues to retry C2 connections every 15 seconds if the server is unreachable.​

The RAT’s C2 traffic uses AES‑128‑CTR with a hardcoded 16‑byte key and per‑message random IV, framing messages as [4‑byte length][16‑byte IV][encrypted JSON].

On first connection, the client exfiltrates a detailed system profile that includes OS type and version, hostname, a machine‑unique ID, current user and permissions, and the path to the payload file, along with a RAT version identifier.​

Supported commands give the operator broad control: they include heartbeat pings, full system info retrieval, interactive shell and PowerShell execution, background command execution, screenshot capture via imagegrabscreen(), and arbitrary file upload and download with world‑writable permissions.

The payload dynamically probes disabled PHP functions and chooses the first available execution primitive from popen, proc_open, exec, shell_exec, system, or passthru, making it resilient against common PHP hardening configurations.​

Mitigations

The most insidious part of the campaign is the use of a clean‑looking package, lara-swagger, to silently pull in the infected lara-helper via a dev-master Composer dependency, allowing the attacker to update the payload without changing the visible swagger package.

Additional clean packages such as lara-syslog and lara-media reference lara-helper in their code or configuration, suggesting the attacker developed all projects with the RAT present as a shared local dependency.​

Any Laravel application that installed lara-helper or simple-queue effectively runs a persistent RAT in the same process and context as the web application, exposing database credentials, API keys env contents, and any files accessible to the application user.

Although the C2 host is reportedly not responding at present, the malware remains on disk and will continue attempting connections, and the operator can redirect traffic or resume operations at any time.

Organizations that have installed any of the affected packages should immediately treat the host as compromised, remove the packages and the helper.php payload, delete the associated lock file, and rotate all secrets accessible from the application environment.

Network defenders should review logs for connections to helper[.]leuleu[.]net:2096 and hunt for suspicious world‑writable files that may have been uploaded via the RAT.

More broadly, security teams are urged to scrutinize transitive Composer dependencies, flag packages that unconditionally load PHP files at boot or autoload time, and avoid dev-master constraints in production, as this incident shows how easily a seemingly benign Laravel utility can become a powerful supply chain backdoor.

Indicators of Compromise (IOCs)

Category	Value
Malicious package	nhattuanbl/lara-helper (Packagist, version 5.4.7) socket+1
Malicious package	nhattuanbl/simple-queue (Packagist, version 1.5) socket+1
Malicious package	nhattuanbl/lara-swagger (Packagist, version 2.0) daily​
Threat actor handle	nhattuanbl daily​
Registered email	nhattuanbl@gmail[.]com
GitLab profile	https://gitlab[.]com/nhattuanbl
GitHub profile	https://github[.]com/nhattuanbl
C2 / network indicator	helper[.]leuleu[.]net:2096 daily​
Malicious file path	src/helper.php daily​
File hash (SHA-256)	a493ce9509c5180e997a04cab2006a48202afbb8edfa15149a4521067191ead7 daily​

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.