Saturday, 23 August, 2025
Linux Malware Evades Detection by Hiding Code in RAR Filenames, Delivers VShell Backdoor
A new Linux-specific attack sends phishing emails with RAR attachments containing maliciously crafted filenames that embed Base64-encoded Bash commands. When a shell script lists these filenames, the code executes—bypassing antivirus tools that don’t inspect filenames. The embedded payload then downloads an ELF binary tailored to the system’s architecture, installs the VShell backdoor, and connects to a C2 server for encrypted control. This stealthy method exploits shell parsing flaws.
Read full story at The Hacker News