Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer

This article covers a supply chain attack compromising 700+ versions of Laravel-Lang PHP packages with a credential stealer.

• •Attackers rewrote git tags in four packages (lang, http-statuses, attributes, actions) to inject malicious commits without modifying source code directly.
• •The malware in src/helpers.php auto-executes when PHP applications start via composer's autoload.files mechanism, requiring no user interaction.
• •The stealer collects cloud provider credentials (AWS, Google Cloud, Azure), Kubernetes tokens, cryptocurrency wallets, browser data, password managers, and development tool credentials, encrypts them with AES-256, and exfiltrates to flipboxstudio[.]info/exfil.

This summary was automatically generated by AI based on the original article and may not be fully accurate.