Laravel Stealer - Post-Exfil Self-Deletion (T1070.004)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Detects the payload cleaning up its tracks by recursively deleting the .laravel_locale temporary artifacts directory after exfiltration.