Over 400 Arch Linux Packages Compromised to Push Rootkit, Infostealer

Over 400 Arch Linux packages compromised to push rootkit, infostealer

More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens. [...]

Atomic Arch: 400+ AUR Packages Backdoored with eBPF Rootkit and Credential Stealer

An AUR supply chain attack compromised more than 400 Arch Linux packages from 11 June 2026, planting a Rust credential stealer and an eBPF rootkit that hides from standard inspection tools. Atomic Arch: 400+ AUR Packages Backdoored with eBPF Rootkit and Credential Stealer on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.

Arch User Repository Removes Over 400 Software Packages Compromised by Malware

The Arch User Repository (AUR for short) is a community-driven software repository for Arch Linux and its derivatives, often touted as one of the major benefits of using Arch Linux, due to its unmatched software availability. Unfortunately, it was recently discovered that several malicious accounts—it's unclear whether they belonged to a single bad actor or multiple users—had made submissions to some AUR packages to inject malware that added the…

400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself. The AUR is Arch Linux’s community package collection, and it is separate This article has been indexed from The Hacker News R…

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself. The AUR is Arch Linux's community package collection, and it is separate