New Perfctl Malware Attacking Millions of Linux Servers

**Perfctl** is a stealthy, persistent Linux-targeting malware campaign that uses rootkits, fileless execution, and TOR-based communications to run Monero cryptominers and proxy-jacking tools across potentially millions of misconfigured servers; the report details its evasion and persistence techniques, exploitation of a Polkit vulnerability, common indicators (suspicious binaries in /tmp, /usr, /root, unusual CPU spikes, TOR traffic), and recommended mitigations such as patching, restricting execution in writable directories, and deploying runtime protections.