Back Thehackernews

Fake Laravel Packages on Packagist Deploy RAT on Windows, macOS, and Linux

Thehackernews •[email protected] (The Hacker News) • March 4, 2026

Cybersecurity researchers have flagged malicious Packagist PHP packages masquerading as Laravel utilities that act as a conduit for a cross-platform remote access trojan (RAT) that's functional on Windows, macOS, and Linux systems. The names of the packages are listed below -

nhattuanbl/lara-helper (37 Downloads) nhattuanbl/simple-queue (29 Downloads) nhattuanbl/lara-swagger (49 Downloads)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack: Malicious Laravel Packages Deploy PHP RAT A supply chain attack has targeted the PHP developer community via Packagist, where threat actor nhattuanbl published malicious packages disguised as Laravel utility libraries. These packages contain a fully functional remote access trojan (RAT), allowing attackers to gain silent and persistent control over systems that install them. 5 sources 40

Extracted Entities

Fake Laravel Packages on Packagist Deploy RAT on Windows, macOS, and Linux

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (4)