New stealthy Quasar Linux malware targets software developers

Trend Micro analyzed a previously undocumented Linux implant called Quasar Linux (QLNX) that targets developers and DevOps environments (npm, PyPI, GitHub, AWS, Docker, Kubernetes). QLNX features a 58-command RAT, dynamic compilation of userland rootkit components, a kernel-level eBPF stealth layer, credential harvesting (including PAM backdoors and SSH/browser/cloud credentials), extensive persistence (LD_PRELOAD, systemd, crontab, init.d, XDG autostart, .bashrc), in-memory execution, process injection, and filesystem monitoring; Trend Micro provided IoCs and notes low detection coverage.