Malicious Laravel Lang Releases Deliver Cross-Platform Backdoor and Credential Stealer
Summary
A compromise of Laravel Lang packages introduced an automatically executed PHP backdoor and a cross-platform stealer targeting credentials and secrets. The article details the attack chain, affected packages, indicators, and recommended response.
Key points
- Suspicious tags were published rapidly across four Laravel Lang repositories on May 22–23, 2026; the article says the activity affected roughly 700 historical versions.
- The affected third-party packages include laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions; they are not part of the official Laravel framework.
- A malicious src/helpers.php file was registered in Composer’s autoload.files, allowing it to run when the Composer autoloader loads.
- The backdoor contacts flipboxstudio[.]info, retrieves a payload, stages it in a hidden temporary directory, and runs it on Linux, macOS, or Windows.
- The second-stage stealer targets cloud, Kubernetes, Vault, CI/CD, browser, password-manager, cryptocurrency, source-control, VPN, and other credentials and secrets.
- The article recommends checking Composer lock files, treating systems that ran affected packages as potentially compromised, rotating exposed secrets, and rebuilding affected systems from known-good images.
- Preserve package artifacts and relevant system, network, cloud, and Kubernetes logs; listed indicators include flipboxstudio[.]info, src/helpers.php, and the .laravel_locale temporary path.
Article Details
- Attack Vectors
- Compromised Laravel Lang packages registered src/helpers.php under Composer autoload.files, causing the backdoor to run automatically when the Composer autoloader ran.
- The backdoor retrieved a payload from the attacker-controlled C2 domain and staged it in a hidden temporary directory before executing it.
- The second-stage payload harvested credentials and sensitive data from files, environment variables, browsers, password managers, cloud metadata, Kubernetes, Vault, CI/CD systems, and other local sources, then encrypted and exfiltrated the data to the C2 server.
- On Windows, the payload used an embedded executable to attempt to bypass Chrome App-Bound Encryption; it also generated and ran a VBS script via cscript.
- Defensive Notes
- Check composer.lock for affected Laravel Lang packages and block them until clean versions are confirmed.
- Treat systems that installed or ran compromised packages as potentially compromised; rebuild affected hosts, containers, and CI runners from known-good images where possible.
- Rotate secrets accessible to affected systems, prioritizing cloud credentials, Kubernetes Service Account tokens, Vault tokens, CI/CD secrets, source-control tokens, SSH keys, Docker registry tokens, Laravel APP_KEY, database credentials, API keys, webhook secrets, and environment-variable credentials.
- Preserve package artifacts and relevant Composer, deployment, process-execution, network/DNS, cloud, Kubernetes, and temporary-directory logs before cleanup.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | flipboxstudio[.]info | Attacker-controlled C2 domain used to retrieve the payload and receive exfiltrated data. |
| URL | hxxps[:]//flipboxstudio[.]info/exfil | C2 exfiltration URL hardcoded in the information-stealing payload. |
| URL | hxxps[:]//flipboxstudio[.]info/payload | Malicious payload-retrieval URL identified in the backdoor analysis. |
MITRE ATT&CK
T1005 · Data from Local SystemThe stealer scans local files and configurations for sensitive data.T1041 · Exfiltration Over C2 ChannelThe payload encrypts harvested data and sends it to the C2 server.T1059.005 · Visual BasicOn Windows, the payload generates and runs a VBS script using cscript.T1105 · Ingress Tool TransferThe backdoor retrieves a second-stage payload from the C2 server.T1552.001 · Credentials In FilesThe stealer searches files such as configuration files, environment-related files, and SSH keys for credentials and secrets.T1552.005 · Cloud Instance Metadata APIThe payload queries cloud instance metadata endpoints to obtain IAM roles and instance identity documents.T1555.003 · Credentials from Web BrowsersBrowser collectors extract history, cookies, and login data from supported browsers.
Products
Composerapplications that installed compromised versions may have executed the backdoor automatically when Composer’s autoloader ran.Laravel LangA compromise affecting the community-maintained Laravel Lang project has introduced remote code execution backdoors across multiple packages in the organization, including laravel-lang/lang, laravel-lang/http-statuses,