search
Linux malware
Trends
- 1Fake Arch Linux packages deliver malware with root accessโโ Fake Arch Linux packages push malware with root privileges โ https://www. bleepingcomputer.com/news/secu rity/fake-arc
Malicious packages posing as legitimate Arch Linux software (AUR packages) are being used to distribute malware that executes with root privileges on infected systems. The campaign targets Linux users who install community-contributed packages, a supply-chain attack vector that has drawn concern in security circles given the trust placed in community repositories.
- 2XCPE Android botnet targeted by new takedown analysisโShutting the Door on the XCPE Botnet (Threat Intelligence) https:// lwn.net/Articles/1104847/ # LWN # Linux # security #
LWN has published a threat intelligence article detailing efforts to shut down the XCPE botnet, which reportedly targets Android and Linux systems. The piece outlines how the malware operates and what defenders can do to close off the attack routes it uses, drawing attention within the Linux and security communities.
- 3ClingSTUN backdoor targets Linux IoT devices via STUN serversโ(blog.polyswarm.io) ClingSTUN: Linux Backdoor Abusing Public STUN Infrastructure for Persistent IoT and Embedded Device
Security researchers at PolySwarm have detailed ClingSTUN, a Linux backdoor that compromises IoT and embedded devices by exploiting known vulnerabilities. The malware abuses public STUN infrastructure to maintain persistent back-connect proxy access, letting attackers relay traffic and stay hidden. Cybersecurity observers are sharing the analysis as a warning that widely deployed embedded Linux devices remain vulnerable to such campaigns.
- 4Critical Node-RED flaw exploited to deploy Linux bot malwareโA critical 10.0 CVSS Node-RED RCE vulnerability (CVE-2026-58115) is exploited in the wild to deploy Linux bot malware. S
A critical remote code execution vulnerability in Node-RED, tracked as CVE-2026-58115 and rated 10.0 on the CVSS scale, is being exploited in the wild. Attackers are using it to compromise exposed instances and deploy Linux bot malware. Security commentators are urging administrators to patch and secure internet-facing Node-RED deployments immediately.
- 5Max-severity OT tool bug exploited to install Linux malwareโMax-severity bug in widely used OT programming tool exploited to deliver Linux malware
A maximum-severity vulnerability in a widely used operational technology programming tool is being actively exploited to deliver Linux malware. Security reporting indicates attackers are leveraging the flaw to compromise industrial environments, raising concerns about targeted intrusions against critical infrastructure. Administrators are being urged to patch affected systems and monitor for signs of compromise.
- 6Researchers Detail RFRx003 Linux Backdoor Used in Targeted Attackโ(rt-solar.ru) Analysis of RFRx003: A Custom Linux Backdoor for Stealthy Lateral Movement and Data Exfiltration In brief
Security researchers at RT-Solar have published an analysis of RFRx003, a custom Linux backdoor used in a 2026 attack on an IT company. The malware enabled attackers to maintain long-term persistence, move laterally across networks, and quietly exfiltrate data. Commenters in the cybersecurity community are sharing the write-up for its technical detail on stealth techniques.
- 7Palo Alto's Unit 42 uncovers SysGoRAT malware campaign targeting Linux serversโUnit 42 reveals the CL-UNK-1211 SysGoRAT malware campaign, where attackers use AI scripts and SysGoRAT malware to breach
Palo Alto Networks' threat research team Unit 42 has disclosed a malware campaign tracked as CL-UNK-1211, in which attackers combine AI-generated scripts with a backdoor called SysGoRAT to breach Linux servers, reportedly including government systems. Security commentators are highlighting the campaign as another sign of attackers adopting AI tooling to automate intrusion work on Linux infrastructure.