Quasar Linux malware targets software developers with rootkit and credential-stealing features

A new stealthy Linux malware, Quasar Linux, is targeting software developers. The implant, found in development environments like npm and GitHub, uses rootkit, backdoor, and credential-stealing capabilities. It dynamically compiles components on target systems for stealth and persistence. Researchers discovered Quasar Linux employs multiple persistence mechanisms and advanced stealth techniques, including kernel-level concealment. Trend Micro has provided indicators of compromise for detection.