Arch Linux Disables AUR Package Adoption Amid Malicious Takeovers
Summary
Arch Linux temporarily disabled AUR package adoption after malicious takeovers. IFIN describes a Tor-staged Linux stealer, while a Reddit user alleges the campaign affects over 200 packages; that scope and the packages’ compromised status are unconfirmed.
Key points
- Arch Linux contributor Robin Candau said package adoption was temporarily disabled amid malicious takeovers and follow-up commits.
- IFIN reports the campaign began July 29 with the openconnect-sso package and has similarities to a June AUR campaign.
- Researchers describe a two-stage Linux x86_64 infection; the loader checks for analysis environments and installs systemd services and cron jobs for persistence.
- The loader reportedly uses a Tor client disguised as dbus-daemon to retrieve a Rust-based infostealer payload.
- The payload targets credentials, wallets, password-manager data, cloud and developer secrets, API keys, SSH keys, and messaging tokens; it also reportedly supports remote command execution and SSH-based lateral spread.
- A Reddit user tracking the campaign alleges more than 200 AUR packages may be affected, including popular packages. Their compromised status has not been independently confirmed, and a full list was unavailable.
Article Details
- Event Type
- Malicious AUR package takeovers and malware distribution campaign
- Impact
- Arch Linux temporarily disabled AUR package adoption after malicious takeovers and follow-up commits. IFIN reported a two-stage Linux stealer campaign that can steal credentials and secrets, establish persistence, execute remote commands, and spread via SSH. A Reddit user alleged the campaign affected more than 200 packages, but the package compromise claims were not independently confirmed.
MITRE ATT&CK
T1021.004 · SSHThe malware reportedly uses stolen SSH keys to spread to other systems.T1053.003 · CronThe first-stage loader reportedly installs cron jobs for persistence.T1105 · Ingress Tool TransferThe loader reportedly retrieves the second-stage payload from an .onion server.T1497.001 · System ChecksThe loader reportedly checks for virtual machines and sandboxes to evade analysis.T1543.002 · Systemd ServiceThe first-stage loader reportedly installs systemd services for persistence.