Arch Linux has pulled three malicious packages uploaded to the Arch User Repository (AUR) were used to install the CHAOS remote access trojan (RAT) on Linux devices. The AUR is a repository where Arch Linux users can publish package build scripts (PKGBUILDs) to automate the process of downloading, building, and installing software that is not included with the operating system. "We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised," warned the Arch Linux team. However, like many other package repositories, the AUR has no format review process for new or updated packages, making it the user's responsibility to review the code and installation scripts before building and installing the package. The packages were removed two days later by the Arch Linux team after being flagged as malicious by the community. Arch users on Reddit quickly found the comments suspicious, with one of them uploading one of the components to VirusTotal, which detects it as the Linux malware called CHAOS RAT. Although all the packages have now been removed, BleepingComputer found archived copies of all three, indicating that the threat actor began submitting the packages at 18:46 UTC on July 16. However, a Reddit account began responding to various Arch Linux threads on the platform today, promoting these packages on the AUR. CHAOS RAT is an open-source remote access trojan (RAT) for Windows and Linux that can be used to upload and download files, execute commands, and open a reverse shell. Due to the severity of the malware, anyone who has mistakenly installed these packages should immediately check for the presence of a suspicious "systemd-initd" executable running on their computer, which may be located in the /tmp folder. The comments were posted by an account that appears to have been dormant for years and likely compromised to spread the malicious packages.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 18 Jul 2025 21:15:18 +0000