New Koske Linux malware hides in cute panda images

Koske is a sophisticated Linux malware campaign that abuses exposed JupyterLab instances to fetch seemingly benign JPEG panda images which are actually polyglot files embedding a shell script and C code. The attack compiles and executes a rootkit in memory (using LD_PRELOAD) while running a memory-resident shell payload that establishes persistence (cron and systemd), evades detection, hardens network settings, and downloads CPU/GPU-optimized cryptominers supporting 18 coins; researchers note indicators (Serbian IPs/phrases, Slovak repo) and suspect AI-assisted development.