Quasar Linux RAT Targets Developers to Steal Supply-Chain Credentials

Trend Micro disclosed a previously undocumented Linux implant, Quasar Linux RAT (QLNX), that targets developer workstations and DevOps environments to steal credentials tied to software supply chains. The malware harvests secrets from assets including npm, PyPI, Git, AWS, Kubernetes, Docker, Vault, Terraform, GitHub CLI, .env files, SSH keys, browser data, and even /etc/shadow, creating a path to malicious package publication, cloud account compromise, and CI/CD abuse. Researchers said the implant combines backdoor, surveillance, credential theft, and lateral movement features, with a 58-command RAT core supporting shell execution, file management, screenshots, keylogging, clipboard theft, SOCKS proxying, TCP tunneling, and SSH-based movement across environments.

The malware was built for stealth and long-term persistence on Linux systems. Trend Micro said QLNX runs filelessly from memory, deletes its original binary, wipes logs, spoofs process names as kernel threads, and uses multiple persistence methods including LD_PRELOAD, systemd, crontab, init.d, XDG autostart, and .bashrc injection. It also dynamically compiles rootkit and PAM credential-interception components on the victim host using gcc, then hides processes, files, and ports through a two-tier design that combines a userland LD_PRELOAD rootkit with an eBPF kernel component. Command-and-control traffic can flow over raw TCP, custom TLS, HTTP, or HTTPS, and at publication only a small number of security products reportedly detected the malware, while no actor attribution or confirmed intrusions had been publicly disclosed.