MEDIUMMalware
Global

Over 400 Arch Linux packages compromised to push rootkit, infostealer

·Source: BleepingComputer

Updated:

Executive Summary

More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens. [...]

Analysis

More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens. [...]
Source Attribution

Originally published by BleepingComputer on Jun 12, 2026.

Related Threats

MEDIUMMalware

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself. The AUR is Arch Linux's community package collection, and it is separate

The Hacker News
MEDIUMMalware

400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself. The AUR is Arch Linux's community package collection, and it is separate

The Hacker News
MEDIUMMalware

Cybercriminals Use Fake AI Guides and Dev Tools to Spread AsyncRAT Malware

Fake AI guides hide a multi-stage chain that drops AsyncRAT, with signs of AI-assisted coding

Infosecurity Magazine