Cybersecuritynews

Supply Chain Attack: Malicious Laravel Packages Deploy PHP RAT

First seen 4 Mar 2026, 06:09 UTC • Gbhackers

•85% similarity •40.3

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A supply chain attack has targeted the PHP developer community via Packagist, where threat actor nhattuanbl published malicious packages disguised as Laravel utility libraries. These packages contain a fully functional remote access trojan (RAT), allowing attackers to gain silent and persistent control over systems that install them.

ThreatCluster AI

Timeline

2026-03-04

Malicious packages discovered on Packagist

2026-03-04

Threat actor nhattuanbl identified as the source

Date unknown

Attackers gain control over affected systems

Attack Flow

11 entities, 16 inferred relationships (STIX 2.1).

Technique (4)

Malware
Supply Chain Attack
Trojan
T1195 - Supply Chain Compromise

Malware (1)

PHP RAT

Affected Platform (6)

Laravel
Linux
MacOS
Packagist
PHP
Windows

Relationships

Malware targets Laravel
Malware targets Linux
Malware targets MacOS
Malware targets Packagist
Supply Chain Attack targets Laravel
Supply Chain Attack targets Linux
Supply Chain Attack targets MacOS
Supply Chain Attack targets Packagist
Trojan targets Laravel
Trojan targets Linux
Trojan targets MacOS
Trojan targets Packagist
T1195 - Supply Chain Compromise targets Laravel
T1195 - Supply Chain Compromise targets Linux
T1195 - Supply Chain Compromise targets MacOS
T1195 - Supply Chain Compromise targets Packagist

Community

Browse all →

Supply Chain Attack: Malicious Laravel Packages Deploy PHP RAT

Ask AI about this cluster

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading