|
jeffv via plug on 15 Jun 2026 10:50:53 -0700
|
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
|
[PLUG] Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
|
- From: jeffv via plug <plug@lists.phillylinux.org>
- To: Philadelphia Linux User's Group Discussion List <plug@lists.phillylinux.org>
- Subject: [PLUG] Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
- Date: Mon, 15 Jun 2026 13:50:45 -0400
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastmailservice.net; s=20211018a; t=1781545848; bh=lA265s0r40RkdHzTwWg89GR6cyA0N5jslS3dUIkSbN8=; h=Received:Received:Message-ID:Date:MIME-Version:To:From:Subject: Content-Type:Xfinity-Spam-Result; b=KEgTQQGLAH2B497ueTtXbbMPoR+0nZMj+q+/5SXUiG6ro+hMOQ2Js3/E/btKdAPs8 kOo2ILNi0sgNyUze7b5PYczs2ZflCi+YXegO8o0ikt7mbojFJUYlu4u31anMFylYma 38yxcAi5llOJSIrvgLF6OBmF990M0m5J1sozaEuAuJ4pfmVF63PUbXuAQ6XB25C8D1 lffXjoPgJN/5krHnu0fyTsewLYozhz1IaOdfigIwFVp5SG69s3sDAOUrIQrAxFDH/4 oA8vq5VdN/lsnufpxLmNQkggqNzLVsXyziflbla3C2GlRaNttOdwk9YPzcgbGn/GCZ RYaknUVZYrwag==
- Reply-to: jeffv <jeffv@op.net>
- Sender: "plug" <plug-bounces@lists.phillylinux.org>
- User-agent: Mozilla Thunderbird
- Xfinity-graffiti: 20900860803
- Xfinity-qid: ZBSPw9Jmt8DPRZBSRw2jik
Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF
Rootkit
https://thehackernews.com/2026/06/over-400-arch-linux-aur-packages.html
Attackers took over more than 400 packages in the Arch User Repository
(AUR) this week and rewrote their build scripts to install a credential
stealer on any machine that built them.
The malware is a Rust binary built to harvest developer secrets. When it
lands with root, it can also load an eBPF rootkit to hide itself. The
AUR is Arch Linux's community package collection, and it is separate
from the official Arch repositories, which were not affected.
___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug