Arch Linux pulls AUR packages that installed Chaos RAT malware

Arch Linux has pulled three malicious packages uploaded to the Arch User Repository (AUR) were used to install the CHAOS remote access trojan (RAT) on Linux devices.

The packages were named "librewolf-fix-bin", "firefox-patch-bin", and "zen-browser-patched-bin," and were uploaded by the same user, "danikpapas," on July 16.

The packages were removed two days later by the Arch Linux team after being flagged as malicious by the community.

"On the 16th of July, at around 8pm UTC+2, a malicious AUR package was uploaded to the AUR," warned the AUR maintainers.

"Two other malicious packages were uploaded by the same user a few hours later. These packages were installing a script coming from the same GitHub repository that was identified as a Remote Access Trojan (RAT)."

Arch users on Reddit quickly found the comments suspicious, with one of them uploading one of the components to VirusTotal, which detects it as the Linux malware called CHAOS RAT.

CHAOS RAT is an open-source remote access trojan (RAT) for Windows and Linux that can be used to upload and download files, execute commands, and open a reverse shell. Ultimately, threat actors have full access to an infected device.

Once installed, the malware repeatedly connects back to a command and control (C2) server where it waits for commands to execute. In this campaign, the C2 server was located at 130.162[.]225[.]47:8080.

The malware is commonly used in cryptocurrency mining campaigns but can also be used for harvesting credentials, stealing data, or conducting cyber espionage.

Due to the severity of the malware, anyone who has mistakenly installed these packages should immediately check for the presence of a suspicious "systemd-initd" executable running on their computer, which may be located in the /tmp folder. If found, it should be deleted.

The Arch Linux team removed all three packages by July 18th at around 6 PM UTC+2.

"We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised," warned the Arch Linux team.