Mastodawn

Sunshine Aug 23, 2025

Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

Phishing emails with RAR archives exploit Linux filename injection to deliver VShell backdoor, bypassing antivirus defenses

The Hacker News

Show thread

pedz Aug 23, 2025

It’s a good explanation and analysis of what it is and what it does.

There’s just one thing that I didn’t see mentioned and it’s about the prevalence of having a software installed to extract rar files in the first place.

AFAIK there’s nothing installed by default on Debian to open rar files. You kind of have to go out of your way to extract one. Unless this changed with the latest release.

I’m not much of a distro hopper so I’d be curious to know, are there distributions where opening and extracting a rar file only requires to click it?

Show thread

whyNotSquirrel Aug 23, 2025

also: antivirus detection, you guys have antivirus? I just install things from the official repository

Show thread

einkorn Aug 23, 2025

Well, recently there have been attacks on Arch based distros via poisened AUR packages.

Show thread

whyNotSquirrel Aug 23, 2025

Isn’t Arch repo a little bit faster to accept packages? From what I understood the point was to make it easier to maintain a package therefore you have the most up to date software version, not sure if this was the problem or anything else, but I have doubt that Debian repositories could be poisoned like this

Show thread

pontiffkitchen0

Just in case you didn’t circle back, the other commenter is correct. Just like Debian repositories, Arch repositories also haven’t been poisoned like this . AUR has recently, but that’s equivalent of like on Debian adding 3rd party repos, but AUR is just a meta collection of those unofficial user repos basically. Arch documentation even warns against blindly installing from AUR, and to read the pkg build first since it’s basically the same thing as copy and pasting a curl command from a GitHub repo’s readme.