CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Quasar Linux (QLNX) multi-stage implant targeting developer environments with rootkit, backdoor, and credential-harvesting capabilities

First reported
Last updated
2 unique sources, 2 articles

Summary

Hide ▲

A previously undocumented Linux implant named Quasar Linux (QLNX) has been identified targeting software developers' systems in development and DevOps environments across npm, PyPI, GitHub, AWS, Docker, and Kubernetes. QLNX combines rootkit, backdoor, and credential-harvesting capabilities to establish stealthy, fileless persistence and enable potential supply-chain attacks. The malware dynamically compiles rootkit shared objects and PAM backdoors on target hosts using gcc, employs seven persistence mechanisms, and uses dual-layer stealth techniques including userland LD_PRELOAD rootkits and kernel-level eBPF components. QLNX features a 58-command RAT core, credential harvesting targeting 10+ configuration files (.npmrc, .pypirc, .aws/credentials, .kube/config, .env, etc.), surveillance, networking and lateral movement, process injection, and filesystem monitoring modules. Targeting developer workstations allows bypass of enterprise security controls and access to credentials underpinning software delivery pipelines, enabling attackers to push poisoned packages to public registries or pivot through CI/CD pipelines.

Timeline

  1. 06.05.2026 01:01 2 articles · 3d ago

    New Quasar Linux (QLNX) implant identified targeting developer environments with multi-stage attack toolkit

    Trend Micro researchers provide additional technical details on QLNX's credential harvesting scope and post-compromise functionality. The implant targets developers and DevOps credentials across the software supply chain, extracting secrets from high-value configuration files including .npmrc (npm tokens), .pypirc (PyPI credentials), .git-credentials, .aws/credentials, .kube/config, .docker/config.json, .vault-token, Terraform credentials, GitHub CLI tokens, and .env files. Compromised credentials could enable attackers to push malicious packages to NPM or PyPI registries, access cloud infrastructure, or pivot through CI/CD pipelines. Additional capabilities revealed include fileless execution from memory with masquerading as kernel threads (e.g., kworker, ksoftirqd), host profiling for container detection, system log wiping, and seven persistence methods (including systemd, crontab, and .bashrc injection). QLNX exfiltrates harvested data to attacker-controlled infrastructure and accepts 58 distinct commands enabling shell execution, file management, process injection, screenshot capture, keystroke logging, SOCKS proxy/TCP tunnel establishment, Beacon Object Files (BOFs) execution, and peer-to-peer mesh network management. The malware includes a PAM inline-hook backdoor intercepting plaintext credentials during authentication events and transmitting them to C2, plus a second PAM-based credentials logger automatically loaded into every dynamically linked process. The two-tiered rootkit architecture combines userland LD_PRELOAD hooks (hiding implant artifacts and processes) with a kernel-level eBPF component that conceals processes, files, and network ports from standard tools upon C2 instruction.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

Cross-Platform Supply Chain Attack Expands with Mini Shai-Hulud Malware via PyPI and npm Ecosystems

A coordinated supply chain attack involving the "Mini Shai-Hulud" credential-stealing malware has expanded beyond npm to compromise the PyPI ecosystem, targeting the popular Python package Lightning with versions 2.6.2 and 2.6.3. The attack introduces a hidden _runtime directory containing a downloader and obfuscated JavaScript payload that executes automatically upon module import, using the Bun runtime to run an 11 MB malicious payload (router_runtime.js) for credential harvesting. The malware validates harvested GitHub tokens via api.github[.]com/user and injects a worm-like payload across up to 50 branches in accessible repositories, with commits authored to impersonate Anthropic's Claude Code. It also implements an npm-based propagation vector using postinstall hooks to spread to downstream users, mirroring techniques used in prior TeamPCP operations. Additional compromises include version 7.0.4 of intercom-client on PyPI, further aligning with the Mini Shai-Hulud campaign's modus operandi. The maintainers of Lightning acknowledged the incident while investigating a suspected compromise of their GitHub account. The attack is assessed as an extension of the Mini Shai-Hulud campaign, with TeamPCP identified as the likely threat actor based on shared technical details and recent operational activity, including the launch of an onion website following suspension from X. The compromised SAP npm packages ([email protected], @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]) were published on April 29, 2026, between 09:55–12:14 UTC, each including malicious preinstall hooks that downloaded the Bun runtime from GitHub Releases and executed a heavily obfuscated execution.js payload. The payload harvested and encrypted developer and cloud secrets, exfiltrating them to attacker-controlled GitHub repositories labeled "A Mini Shai-Hulud has Appeared", while self-propagating via GitHub Actions workflow injection and abusing AI tool configurations (VS Code and Claude Code) for persistence. Additional exfiltration techniques included a Python-based memory scanner targeting CI runner secrets and a dead-drop mechanism leveraging GitHub commit searches for base64-encoded GitHub tokens.

Open in new tab

Self-propagating North Korean job-scam malware spreads via compromised developer projects in software supply chain

A North Korean state-aligned actor has transformed fake job recruitment scams into a self-propagating supply-chain attack dubbed "Contagious Interview" that infects developer workstations and propagates via compromised repositories. Void Dokkaebi (aka Famous Chollima) abuses legitimate development workflows by luring developers with fake interviews, then delivering malware via malicious VS Code tasks or hidden payloads in fonts/images. Once committed to Git repositories, the infection spreads to downstream contributors, creating a worm-like chain reaction. Developers’ credentials, crypto wallets, CI/CD pipelines, and production infrastructure are primary targets. Newly identified activity connected to the same actor’s PromptMink campaign targets cryptocurrency developers via malicious npm packages, including @validate-sdk/v2, co-authored by an AI coding assistant. The layered package strategy uses legitimate-looking tools to hide malicious payloads, with payloads evolving from credential theft to broader data exfiltration, persistence mechanisms, and cross-platform binaries. Over 60 packages and 300+ versions have been identified across seven months, with evidence of LLM integration in malware development.

Open in new tab

Targeted social engineering of Axios maintainer enables UNC1069 npm supply chain compromise via WAVESHAPER.V2 implant

A maintainer of the widely used Axios npm package was targeted in a highly tailored social engineering campaign attributed to North Korean threat actor UNC1069, resulting in the compromise of npm account credentials and the publication of two trojanized versions of Axios (1.14.1 and 0.30.4). Google Threat Intelligence Group (GTIG) attributed the attack to UNC1069 based on the use of WAVESHAPER.V2 and infrastructure overlaps with past activities. The malicious packages were available for roughly three hours and injected a plain-crypto-js dependency that installed a cross-platform RAT, enabling credential theft and downstream compromise. The campaign also targeted additional maintainers, including Pelle Wessman (Mocha framework) and Node.js core contributors, revealing a coordinated effort against high-impact maintainers. The intrusion began with reconnaissance-driven impersonation of a legitimate company founder, engagement via a cloned Slack workspace and Microsoft Teams call, and execution of a fake system update that deployed the RAT. Post-incident, the maintainer reset devices, rotated all credentials, adopted immutable releases, introduced OIDC-based publishing flows, and updated GitHub Actions workflows to mitigate future risks.

Open in new tab

Ongoing Ghost Cluster Targets npm and GitHub in Multi-Stage Credential and Crypto Wallet Theft Campaign

A coordinated campaign tracked as Ghost continues to target developers via malicious npm packages and GitHub repositories to deploy credential stealers and cryptocurrency wallet harvesters. The operation leverages social engineering and multi-stage infection chains, including fake installation wizards that request sudo/administrator privileges and deceptive npm logs simulating dependency downloads and progress indicators. Stolen data—including browser credentials, crypto wallets, SSH keys, and cloud tokens—is exfiltrated to Telegram channels and BSC smart contracts. The campaign employs a dual monetization model combining credential theft via Telegram channels with affiliate link redirections stored in a BSC smart contract. Malicious npm packages first appeared under the user 'mikilanjijo', with operations beginning as early as February 2026 and expanding to at least 11 packages such as react-performance-suite and react-query-core-utils. The final payload is a remote access trojan that downloads from Telegram channels, decrypts using externally retrieved keys, and executes locally using stolen sudo passwords to harvest credentials and deploy GhostLoader.

Open in new tab

Malicious nx Packages Exfiltrate Credentials in 's1ngularity' Supply Chain Attack

The **UNC6426** threat actor has weaponized credentials stolen during the August 2025 **nx npm supply-chain attack** to execute a rapid cloud breach, escalating from a compromised GitHub token to **full AWS administrator access in under 72 hours**. By abusing GitHub-to-AWS OpenID Connect (OIDC) trust, the attacker deployed a new IAM role with `AdministratorAccess`, exfiltrated S3 bucket data, terminated production EC2/RDS instances, and **publicly exposed the victim’s private repositories** under the `/s1ngularity-repository-[randomcharacters]` naming scheme. This follows the broader *Shai-Hulud* and *SANDWORM_MODE* campaigns, which collectively compromised **over 400,000 secrets** via trojanized npm packages, GitHub Actions abuse, and AI-assisted credential harvesting (e.g., QUIETVAULT malware leveraging LLM tools). The attack chain began with the **Pwn Request** exploitation of a vulnerable `pull_request_target` workflow in nx, leading to trojanized package publication and theft of GitHub Personal Access Tokens (PATs). UNC6426 later used tools like **Nord Stream** to extract CI/CD secrets, highlighting the risks of **overprivileged OIDC roles** and **standing cloud permissions**. Researchers warn of escalating supply chain risks, including **self-propagating worms** (Shai-Hulud), **PackageGate vulnerabilities** bypassing npm defenses, and **AI-assisted prompt injection** targeting developer workflows. Mitigations include disabling postinstall scripts, enforcing least-privilege access, and rotating all credentials tied to npm, GitHub, and cloud providers.

Open in new tab