Malicious Laravel Packages Deploy PHP RAT, Grant Remote Access to Attackers

Malicious Packagist packages published by the actor "nhattuanbl" (notably nhattuanbl/lara-helper and nhattuanbl/simple-queue) contain an obfuscated PHP RAT (src/helper.php) that relaunches as a background process, connects to a C2 at helper.leuleu.net:2096 using AES‑128‑CTR framing, exfiltrates host reconnaissance data, and provides remote shell, command execution, file upload/download, screenshots, and persistence; a benign-appearing package (nhattuanbl/lara-swagger) depends on lara-helper transitively enabling stealthy supply-chain installation—organizations should treat affected hosts as compromised, remove the packages and helper.php, delete the lock file, rotate secrets, and hunt for C2 connections and suspicious world-writable files.