Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
Attackers hijacked over 400 packages in the Arch User Repository (AUR) by adopting orphaned projects and modifying build scripts to deploy a…
Tag: eBPF rootkit
Atomic Arch: Supply Chain Attack on Arch Linux AUR
A campaign tracked by Sonatype as Atomic Arch (Sonatype-2026-003775) hijacked over 400 AUR packages to deploy a Rust-based credential stealer and optional…
deps: Rust Credential Stealer Payload
The deps binary is a Rust credential stealer that harvests browser cookies, tokens, SSH keys, and cloud credentials from developer workstations. It…