Invisible Intruder: “ShadowHS” Malware Weaponizes Hackshell on Linux

Cyble Research & Intelligence Labs uncovered ShadowHS, a sophisticated fileless Linux intrusion campaign that uses a multi-stage in-memory loader to deploy a weaponized version of hackshell for interactive, operator-driven post-exploitation. The framework evades detection through process name spoofing and anonymous file descriptors, fingerprints and disables EDR/competing malware, supports credential theft, SSH lateral movement and privilege escalation, and exfiltrates data covertly via user-space tunneling (GSocket).