Linux Malware Archives • Daily CyberSecurity

XMRig Botnet Abuses Linux PAM to Spread Forensic Smokescreen Across User Accounts XMRig Linux PAM abuse fileless cryptominer V25 botnet forensic smokescreen

XMRig Linux PAM abuse fileless cryptominer V25 botnet forensic smokescreen

XMRig Botnet Abuses Linux PAM to Spread Forensic Smokescreen Across User Accounts

Do Son August 5, 2026

At a glance Field Detail Malware family Modified XMRig 6.25.0 botnet implant (marked “PRIVATE VERSION FOR BOTNET”),...

Tengu Botnet Is a Modernized Mirai Variant That Fights to Stay on IoT Devices malware-code

Tengu Botnet Is a Modernized Mirai Variant That Fights to Stay on IoT Devices

Do Son August 3, 2026

At a glance Malware family Tengu (Mirai-derived IoT botnet) Threat actor Unattributed; no operator named Target Internet-facing...

Security Alert: Cemu Emulator Linux Releases Compromised via GitHub Backdoor (May 2026) Cemu emulator Linux malware Blitz Brigantine AOBackdoor GitHub Malware Campaign StealC Infostealer TamperedChef Malware, SEO Poisoning Carbanak malware RubyGems Supply Chain, Infostealer

Cemu emulator Linux malware Blitz Brigantine AOBackdoor GitHub Malware Campaign StealC Infostealer TamperedChef Malware, SEO Poisoning Carbanak malware RubyGems Supply Chain, Infostealer

Security Alert: Cemu Emulator Linux Releases Compromised via GitHub Backdoor (May 2026)

Do Son May 13, 2026

The renowned open-source Wii U emulator, Cemu, has promulgated a security bulletin detailing a sophisticated compromise of...

APT41’s New “Zero-Detection” Backdoor Targets Linux Workloads APT41 Linux Backdoor SMTP Command and Control

APT41’s New “Zero-Detection” Backdoor Targets Linux Workloads

Do Son April 15, 2026

A sophisticated new threat has been unmasked targeting the heart of enterprise cloud infrastructure. Researchers from Breakglass...

New Mirai Variant and “Monaco” Miner Targeting Linux Devices Linux Malware CondiBot

New Mirai Variant and “Monaco” Miner Targeting Linux Devices

Do Son March 20, 2026

Security researchers at Eclypsium have identified two distinct and previously undocumented malware strains targeting Linux-based systems. On...

Silently Swapped: How ClipXDaemon Hijacks Linux Cryptowallets Without a C2 Server ClipXDaemon Linux Malware

Silently Swapped: How ClipXDaemon Hijacks Linux Cryptowallets Without a C2 Server

Do Son March 10, 2026

Cybersecurity researchers have identified a specialized new threat targeting Linux users that breaks the traditional mold of...

VoidLink Rising: New “AI-Ready” Malware Framework Targets Linux & IoT VoidLink Framework UAT-9921 Russian hacking group

VoidLink Rising: New “AI-Ready” Malware Framework Targets Linux & IoT

Do Son February 12, 2026

A new and sophisticated threat actor has emerged from the shadows, wielding a modular attack framework designed...

Invisible Intruder: “ShadowHS” Malware Weaponizes Hackshell on Linux ShadowHS Malware Linux Fileless Intrusion

Invisible Intruder: “ShadowHS” Malware Weaponizes Hackshell on Linux

Do Son February 4, 2026

Cyble Research & Intelligence Labs (CRIL) has uncovered a sophisticated Linux intrusion chain dubbed ShadowHS, a campaign...

IIS Under Siege: UAT-8099 Deploys Region-Locked “BadIIS” & Linux Variants UAT-8099 BadIIS Malware Pacific Islands Forum Cyberattack

IIS Under Siege: UAT-8099 Deploys Region-Locked “BadIIS” & Linux Variants

Do Son February 2, 2026

A sophisticated cyber campaign targeting Internet Information Services (IIS) servers across Asia has evolved with new, highly...

VoidLink: The “Cloud-First” Malware Hunting Your Linux Servers Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

VoidLink: The “Cloud-First” Malware Hunting Your Linux Servers

Do Son January 14, 2026

A new, highly sophisticated malware framework has emerged from the shadows, specifically engineered to infest the modern...

The BOSS Breach: APT36 Pivots to Linux Espionage with “Silent” Shortcuts Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

The BOSS Breach: APT36 Pivots to Linux Espionage with “Silent” Shortcuts

Do Son December 2, 2025

A prominent state-aligned threat actor has significantly evolved its arsenal, launching a sophisticated campaign targeting the Linux-based...

APT36 Suspected in India Gov Spoofing Phishing with ClickFix Tactics APT36 phishing, ClickFix campaign

APT36 Suspected in India Gov Spoofing Phishing with ClickFix Tactics

Do Son May 8, 2025

Hunt.io, a threat hunting platform, has revealed a sophisticated phishing campaign using ClickFix-style tactics and spoofed Indian...

Outlaw Botnet Exploits Weak SSH to Hijack Linux Systems for Crypto Mining Outlaw botnet, Linux crypto mining

Outlaw Botnet Exploits Weak SSH to Hijack Linux Systems for Crypto Mining

Do Son May 1, 2025

While high-profile ransomware and state-backed APT groups often dominate headlines, it’s crucial not to overlook quieter yet...

XorDDoS Evolves: Cisco Talos Uncovers “VIP” Controller Fueling Global DDoS Campaigns

Do Son April 19, 2025

A new report from Cisco Talos Intelligence Group reveals the continued global spread and evolution of the...

Outlaw Linux Malware: Persistent Threat Leveraging Simplicity

Do Son April 3, 2025

Elastic Security Labs has published an analysis on the Outlaw Linux malware, describing it as a persistent...

Linux Malware DISGOMOJI Targets Indian Officials UTA0137

Linux Malware DISGOMOJI Targets Indian Officials

Do Son June 16, 2024

Cybersecurity firm Volexity has revealed a new cyber-espionage campaign targeting Indian government entities, employing a custom-built malware...