{"id":1027,"date":"2026-05-23T11:11:56","date_gmt":"2026-05-23T11:11:56","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1027"},"modified":"2026-05-23T11:11:56","modified_gmt":"2026-05-23T11:11:56","slug":"laravel-lang-php-packages-compromised-to-deliver-cross-platform-credential-stealer","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1027","title":{"rendered":"Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">May 23, 2026<\/span><\/span><span class=\"p-tags\">Supply Chain Attack \/ Malware<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgkqwlAgmL-HrE2pSx8xqfY4-AyYZ59wK4x5AWtnCXSHRoBO1wcYTpWw42Fe6VRoAT77e914MSqZW56fKX95IueHTCrk10XNn2Yxh7CU8iCdX5lzFowGeVkolW-4E3po81w9pFMsaLR_r85abtUv3bwvQMa6pP1BAiSj4DrmapTiYr1twfV61tvGdWJRgs8\/s1700-e365\/lang-hack.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to  Laravel-Lang to deliver a comprehensive credential-stealing framework.<\/p>\n<p>The affected packages include &#8211;<\/p>\n<ul>\n<li>laravel-lang\/lang<\/li>\n<li>laravel-lang\/http-statuses<\/li>\n<li>laravel-lang\/attributes<\/li>\n<li>laravel-lang\/actions<\/li>\n<\/ul>\n<p>\u00abThe timing and pattern of the newly published tags point to a broader compromise of the Laravel Lang organization&#8217;s release process, rather than a single malicious package version,\u00bb Socket <a href=\"https:\/\/socket.dev\/blog\/laravel-lang-compromise\" target=\"_blank\">said<\/a>. \u00abThe tags were published in rapid succession on May 22 and May 23, 2026, with many versions appearing only seconds apart.\u00bb<\/p>\n<p>More than 700 versions associated with these packages have been identified, indicating automated mass tagging or republishing. It&#8217;s suspected that the attacker may have managed to obtain access to organization-level credentials, repository automation, or release infrastructure.<\/p>\n<p>The core malicious functionality is located in a file named \u00absrc\/helpers.php\u00bb that&#8217;s embedded into the version tags. It&#8217;s mainly designed to fingerprint the infected host and contact an external server (\u00abflipboxstudio[.]info\u00bb) to retrieve a PHP-based cross-platform payload that runs on Windows, Linux, and macOS.<\/p>\n<p>According to Aikido Security, the dropper delivers a Visual Basic Script launcher on Windows and runs it via cscript. On Linux and macOS, it executes the stealer payload via exec().<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/threatlabz-vpn-risk-2026-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhnNON5UeWywT7OcPNw7V4L7QNWnCnm7Xl_99Y9ek8dL-gRwx-bWxQM1TKqt8deqqrdpUyKMuuijAWyyPQVB0s0qf8ntQ6ldFAJLru-QUWhddKTopc7SeNbBBnd-TsfFyRPP-AAyDuclLlL6XHK4_LXqDC_7eyaz9pzToYr7U543MhrJ7qcK-89sVWHTQUZ\/s728-e100\/zz-2-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>\u00abBecause this file [&#8216;src\/helpers.php&#8217;] is registered in the composer.json under autoload.files, the backdoor is executed automatically on every PHP request handled by the compromised application,\u00bb Socket explained.<\/p>\n<p>\u00abThe script generates a unique per-host marker (an MD5 hash combining the directory path, system architecture, and inode) to ensure the payload only triggers once per machine. This prevents redundant executions and helps the malware remain undetected after the initial run.\u00bb<\/p>\n<p>The stealer is equipped to harvest a wide range of data from compromised systems and exfiltrate it to the same server. This includes &#8211;<\/p>\n<ul>\n<li>IAM roles and instance identity documents by querying cloud metadata endpoints<\/li>\n<li>Google Cloud application default credentials<\/li>\n<li>Microsoft Azure access tokens and service principal profiles<\/li>\n<li>Kubernetes Service Account tokens and Helm registry configurations<\/li>\n<li>Authentication tokens for DigitalOcean, Heroku, Vercel, Netlify, Railway and Fly.io<\/li>\n<li>HashiCorp Vault tokens<\/li>\n<li>Tokens and configurations from Jenkins, GitLab Runners, GitHub Actions, CircleCI, TravisCI, and ArgoCD<\/li>\n<li>Seed phrases and files associated with cryptocurrency wallets (Electrum, Exodus, Atomic, Ledger Live, Trezor, Wasabi, and Sparrow) and extensions (MetaMask, Phantom, Trust Wallet, Ronin, Keplr, Solflare, and Rabby)<\/li>\n<li>Browser history, cookies, and login data from Google Chrome, Microsoft Edge, Mozilla Firefox, Brave, and Opera by using a Base64-encoded embedded Windows executable that bypass Chromium&#8217;s app-bound encryption (<a href=\"https:\/\/thehackernews.com\/2024\/08\/google-chrome-adds-app-bound-encryption.html\" target=\"_blank\">ABE) protections<\/li>\n<li>Local vaults and browser extension data for 1Password, Bitwarden, LastPass, KeePass, Dashlane, and NordPass<\/li>\n<li>PuTTY\/WinSCP saved sessions<\/li>\n<li>Windows Credential Manager dumps<\/li>\n<li>WinSCP saved sessions<\/li>\n<li>RDP files<\/li>\n<li>Session tokens associated with applications like Discord, Slack, and Telegram<\/li>\n<li>Data from Microsoft Outlook, Thunderbird, and popular FTP clients (FileZilla, WinSCP, and CoreFTP)<\/li>\n<li>Configuration and credential files containing Docker auth tokens, SSH private keys, Git credentials, shell history files, database history files, Kubernetes cluster configurations, .env files, wp-config.php, and docker-compose.yml<\/li>\n<li>Environment variables loaded into the PHP process<\/li>\n<li>Source control credentials from global and local .gitconfig files, .git-credentials, and .netrc files<\/li>\n<li>VPN configuration and saved login files for OpenVPN, WireGuard, NetworkManager, and commercial VPNs such as NordVPN, ExpressVPN, CyberGhost, and Mullvad<\/li>\n<\/ul>\n<p>\u00abThe fetched payload is a ~5,900 line PHP credential stealer, organised into fifteen specialist collector modules,\u00bb Aikido researcher Ilyas Makari <a href=\"https:\/\/www.aikido.dev\/blog\/supply-chain-attack-targets-laravel-lang-packages-with-credential-stealer\" target=\"_blank\">said<\/a>. \u00abAfter collecting everything it can find, it encrypts the results with AES-256 and sends them to flipboxstudio[.]info\/exfil. It then deletes itself from the disk to limit forensic evidence.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802May 23, 2026Supply Chain Attack \/ Malware Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver&hellip;<\/p>\n","protected":false},"author":1,"featured_media":1028,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[227,459,342,529,1776,35,1067,478],"class_list":["post-1027","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-compromised","tag-credential","tag-crossplatform","tag-deliver","tag-laravellang","tag-packages","tag-php","tag-stealer"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1027","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1027"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1027\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1028"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1027"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1027"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1027"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}