Netskope Threat Labs

PHP.Agent

ATP Sandbox Adv. HeuristicsAV

This generic detection identifies malicious PHP code that performs unauthorized actions on web servers, without attributing it to a specific family.

First seen
January 2022
Last seen
October 2026
PHPAgentPhp.Agent
Alert Name
Backdoor.Php.Agent.LZ
Backdoor.PHP.Agent.MX
Backdoor.PHP.Agent.NY
Backdoor.PHP.Agent.PD
Backdoor.PHP.Agent.QL
Backdoor.PHP.Agent.RO
Backdoor.PHP.Agent.RT
Backdoor.PHP.Agent.RW
Backdoor.PHP.Agent.SF
Dropped:Trojan.PHP.Agent.AAG