A newly discovered Linux implant called Quasar Linux, or QLNX, is a serious threat because it goes after the people and systems that build software. Instead of behaving like ordinary malware, it is designed to quietly take root in developer and DevOps environments, steal valuable credentials, and open the door to supply-chain attacks.
QLNX is dangerous because it combines several attack techniques in one package. Trend Micro says it can function as a rootkit, a backdoor, and a credential stealer, while also running filelessly, wiping logs, spoofing process names, and removing its original binary from disk to make investigation harder. It also uses multiple persistence methods, including LD_PRELOAD, systemd, crontab, init.d scripts, XDG autostart, and .bashrc injection, so it can keep coming back even if part of it is removed.
The malware’s main prize is access to developer secrets. Researchers say it targets credentials tied to npm, PyPI, GitHub, AWS, Docker, Kubernetes, Terraform, and other tools that are deeply embedded in modern software delivery pipelines. If attackers get those tokens or keys, they can publish malicious packages, tamper with builds, or move from one system into cloud infrastructure and CI/CD environments.
What makes the threat especially troubling is how stealthy it is. Trend Micro found that QLNX can dynamically compile rootkit and PAM backdoor components on the victim host using gcc, which helps it blend in with normal Linux activity. It also harvests clipboard contents, SSH keys, browser profiles, and authentication data, giving attackers a wide view into how developers work and where their secrets are stored.
The broader issue is that developer machines have become high-value targets in the software supply chain. One compromised workstation can expose publishing pipelines, cloud accounts, and internal codebases, so the impact may spread far beyond the original victim. The safest response is to treat developer endpoints like crown-jewel systems: monitor for unusual persistence, restrict secret storage, rotate tokens quickly, and assume a stolen workstation could become the first step in a wider breach.
This article has been indexed from CySecurity News – Latest Information Security and Hacking Incidents
Read the original article: