CERT24Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF RootkitLoading data…
CERT24Threat Observatory
Period

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Attackers took over more than 400 Arch User Repository (AUR) packages and modified their build scripts to install a Rust-based infostealer when the packages were built. If the malware runs with root privileges, it can also load an eBPF rootkit. The source states that the official Arch repositories were not affected.

← Back to intelligence

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Attackers took over more than 400 Arch User Repository (AUR) packages and modified their build scripts to install a Rust-based infostealer when the packages were built. If the malware runs with root privileges, it can also load an eBPF rootkit. The source states that the official Arch repositories were not affected.