{"id":1294,"date":"2026-06-12T21:27:10","date_gmt":"2026-06-12T21:27:10","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1294"},"modified":"2026-06-12T21:27:10","modified_gmt":"2026-06-12T21:27:10","slug":"over-400-arch-linux-aur-packages-hijacked-to-deploy-infostealer-and-ebpf-rootkit-2","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1294","title":{"rendered":"Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit"},"content":{"rendered":"<p><br \/>Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them.<\/p>\n<p>The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself. The AUR is Arch Linux&#8217;s community package collection, and it is separate<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built&hellip;<\/p>\n","protected":false},"author":1,"featured_media":1293,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[2030,2031,229,2032,804,695,181,35,1197],"class_list":["post-1294","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-arch","tag-aur","tag-deploy","tag-ebpf","tag-hijacked","tag-infostealer","tag-linux","tag-packages","tag-rootkit"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1294","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1294"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1294\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1293"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1294"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1294"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1294"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}