Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer

The attack, as detailed by Socket and StepSecurity, began with the rapid publication of numerous versions of Laravel-Lang packages, indicating a coordinated effort. The core of the malicious activity resides in a 'src/helpers.php' file embedded within these tags. This file, discovered by Aikido Security, acts as a dropper, initiating a cross-platform credential-stealing operation. According to Aikido Security, the attacker registered this file in the composer.json's autoload.files map, ensuring execution upon every PHP request handled by the compromised application. The script utilizes techniques like querying cloud metadata endpoints (Google Cloud, Azure) and leveraging application default credentials to gather sensitive information. The attacker added the file to the autoload.files map, meaning every Laravel application would execute the payload automatically upon startup. The script generates a unique per-host marker (an MD5 hash) to prevent redundant executions and aid in evasion. The payload itself is a sophisticated PHP-based credential stealer, approximately 5,900 lines of code, organized into fifteen specialized collector modules. It’s designed to harvest a vast array of data, including IAM roles, instance identity documents, Kubernetes Service Account tokens, and even seed phrases for cryptocurrency wallets. The attacker uses techniques like Base64 encoding to bypass Chromium's app-bound encryption (ABE) protections, allowing the payload to execute directly within the browser. Furthermore, the malware actively seeks out and extracts configuration files such as .env files, wp-config.php, and docker-compose.yml, increasing the potential impact of the compromise. The collected data is then encrypted with AES-256 and transmitted to the attacker's server, flipboxstudio[.]info, for exfiltration. The malware also deletes itself from the disk to minimize forensic evidence. According to Ilyas Makari, the malware is organized into fifteen specialist collector modules, each designed to target specific types of credentials and data. The attacker's use of techniques like MD5 hashing and AES-256 encryption demonstrates a sophisticated understanding of security evasion and data protection.