APT36 hackers abuse Linux .desktop files to install malware in new attacks

APT36 is running an active espionage campaign against Indian government and defense targets by abusing Linux .desktop files delivered in phishing ZIPs; the malicious .desktop entries run shell commands to fetch and write a hex-encoded Go-based ELF payload to /tmp, make it executable, launch it (while opening a decoy PDF), and establish persistence (autostart, cron, systemd) and bi-directional WebSocket C2 for data exfiltration and remote control.