Back Cybersecuritynews

Malicious Packages Disguised as Laravel Utilities Deploy PHP RAT and Enables Remote Access

Cybersecuritynews •Tushar Subhra Dutta • March 4, 2026

A supply chain attack targeting the PHP developer community has surfaced through Packagist, the official package repository for PHP and Laravel projects. Threat actor nhattuanbl published several packages that disguised a fully functional remote access trojan (RAT) inside what looked like standard Laravel utility libraries, giving attackers silent and persistent control over any system that installed them. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack: Malicious Laravel Packages Deploy PHP RAT A supply chain attack has targeted the PHP developer community via Packagist, where threat actor nhattuanbl published malicious packages disguised as Laravel utility libraries. These packages contain a fully functional remote access trojan (RAT), allowing attackers to gain silent and persistent control over systems that install them. 5 sources 40

Extracted Entities

Malicious Packages Disguised as Laravel Utilities Deploy PHP RAT and Enables Remote Access

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)