Attackers are Using WSL2 as a Stealthy Hideout Inside Windows Systems

The report warns that attackers are increasingly abusing WSL2 — which runs Linux distros as Hyper-V VMs — to hide tools and payloads inside the Linux guest where many Windows-focused security products do not monitor, enabling stealthy command execution, lateral movement, credential theft and data staging; SpecterOps research demonstrates how a beacon object can reach into installed WSL2 distros and execute commands with minimal Windows telemetry, increasing dwell time and complicating detection and investigation.