Live Feed

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit - The Hacker News

Reported by The Hacker News | June 12, 2026, 7:35 pm

Article Image

Attackers hijacked 400+ Arch Linux AUR packages to run a Rust credential stealer, with optional eBPF rootkit support on root systems.

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them.
The malware is …

Want to read the full report?

You are viewing a syndication snippet provided by the publisher via NewsAPI.

Read Full Story on Publisher Site ↗