400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer

Over 400 Arch Linux AUR packages were hijacked to distribute a Rust credential stealer with optional eBPF rootkit capability.

• •Malware steals browser cookies, GitHub/npm/Vault tokens, SSH keys, and Slack/Discord/Teams session data
• •Attackers adopted abandoned packages and modified build scripts to execute malicious npm install (atomic-lockfile)
• •Payload installs systemd services for persistence and can hide itself with eBPF when running as root
• •Users must verify packages updated after June 11 and rotate all exposed credentials and SSH keys

This summary was automatically generated by AI based on the original article and may not be fully accurate.