Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

[Brownie2019]

Content source

https://thehackernews.com/2025/08/linux-malware-delivered-via-malicious.html

Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell.

The "Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file," Trellix researcher Sagar Bade said in a technical write-up.

"The payload isn't hidden inside the file content or a macro, it's encoded directly in the filename itself. Through clever use of shell command injection and Base64-encoded Bash payloads, the attacker turns a simple file listing operation into an automatic malware execution trigger."

The technique, the cybersecurity company added, takes advantage of a simple yet dangerous pattern commonly observed in shell scripts that arises when file names are evaluated with inadequate sanitization, thereby causing a trivial command like eval or echo to facilitate the execution of arbitrary code.

Full Story on:

Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

Phishing emails with RAR archives exploit Linux filename injection to deliver VShell backdoor, bypassing antivirus defenses

thehackernews.com

 

[Behold Eck]

Don`t open unsolicited emails with rar attachments like as if you would?

Regards Eck

 

[simmerskool]

Don`t open unsolicited emails with rar attachments like as if you would?

Regards Eck

yeah but my fedora firefox runs firejailed behind selinux -- is it safe? probably not, I assume the bad guys are at least 1 step ahead of me, but I'm not paranoid

 

[Behold Eck]

yeah but my fedora firefox runs firejailed behind selinux -- is it safe? probably not, I assume the bad guys are at least 1 step ahead of me, but I'm not paranoid

Maybe with that extra security you`re tempted to open it as a test to prove how invulnerable you are ?

Where as if you were running plain vanilla you`d be that bit more cautious, which makes having more security less security, if you see what I mean?

What is selinux by the way ?

Regards Eck

 

[Zero Knowledge]

yeah but my fedora firefox runs firejailed behind selinux -- is it safe? probably not, I assume the bad guys are at least 1 step ahead of me, but I'm not paranoid

Helluva setup there , not sure anything could breach that but maybe replace Fedora with Qubes and connect using a Starlink proxy in Area 51 and your set

 

[ForgottenSeer 123960]

yeah but my fedora firefox runs firejailed behind selinux -- is it safe? probably not, I assume the bad guys are at least 1 step ahead of me, but I'm not paranoid

The combination of Firejail and SELinux would provide significant protection against the VShell attack chain. Neither of these technologies is designed to block the initial download, but they are highly effective at preventing the subsequent steps of the attack.

In its default enforcing mode on Fedora, SELinux would recognize the malicious actions of the VShell malware as a violation of its security policy. It would then block them, logging each denial. This effectively neutralizes the malware's ability to operate and establish a persistent presence on the system. Firejail contains the initial exploit by isolating the browser, while SELinux prevents the malware from performing its core functions even if it manages to bypass the sandbox. For an attacker to succeed, they would have to defeat both layers of security, which is an extremely difficult task.

 

[simmerskool]

Maybe with that extra security you`re tempted to open it as a test to prove how invulnerable you are ?

Where as if you were running plain vanilla you`d be that bit more cautious, which makes having more security less security, if you see what I mean?

What is selinux by the way ?

Regards Eck

Security-Enhanced Linux (SELinux) is a security architecture for Linux® systems that allows administrators to have more control over who can access the system. It was originally developed by the United States National Security Agency (NSA) as a series of patches to the Linux kernel using Linux Security Modules (LSM).
SELinux was released to the open source community in 2000, and was integrated into the upstream Linux kernel in 2003.
and I am reasonably careful even in this VM.

What is SELinux?

Security-Enhanced Linux (SELinux) is a security architecture for Linux® systems that allows administrators to have more control over who can access the system.

www.redhat.com

 

[simmerskool]

Helluva setup there , not sure anything could breach that but maybe replace Fedora with Qubes and connect using a Starlink proxy in Area 51 and your set

Qubes would rather run in hardware computer (from what I've read) -- I'm not there... yet

 

[simmerskool]

The combination of Firejail and SELinux would provide significant protection against the VShell attack chain. Neither of these technologies is designed to block the initial download, but they are highly effective at preventing the subsequent steps of the attack. [snip] For an attacker to succeed, they would have to defeat both layers of security, which is an extremely difficult task.

plus some select browser extensions... etc. And (but) chatGPT 5 thinks my M4 mac_mini is the strongest computer (I'm lucky enough to have).

 

[Behold Eck]

Security-Enhanced Linux (SELinux) is a security architecture for Linux® systems that allows administrators to have more control over who can access the system. It was originally developed by the United States National Security Agency (NSA) as a series of patches to the Linux kernel using Linux Security Modules (LSM).
SELinux was released to the open source community in 2000, and was integrated into the upstream Linux kernel in 2003.
and I am reasonably careful even in this VM.

What is SELinux?

Security-Enhanced Linux (SELinux) is a security architecture for Linux® systems that allows administrators to have more control over who can access the system.

www.redhat.com

Thanks for the information simmerskool seems like you`re all set to repulse a combined land and sea invasion from a foreign country with all that granular control you have.

Meanwhile back at the ranch, I`ve just enabled the firewall in Linux Mint and that`ll do me for now with my first toddler steps in Linux security

Regards Eck

 

[ForgottenSeer 123960]

plus some select browser extensions... etc. And (but) chatGPT 5 thinks my M4 mac_mini is the strongest computer (I'm lucky enough to have).

SELinux is a powerful security tool, but it's just one part of keeping your Fedora system safe. A solid security foundation requires a few other critical steps.

First, and most importantly, consistently updating your system with the dnf package manager is your best first line of defense, as it patches all known vulnerabilities.

Beyond that, you should focus on minimizing your attack surface by disabling any unnecessary services, the fewer services running, the fewer potential entry points there are for an attacker.

For your data's protection, full disk encryption during installation is a must, as it safeguards your information even if someone physically gets their hands on your machine. When it comes to user and access control, Fedora's default settings are already quite strong, disabling direct root login and encouraging the use of sudo, a key security best practice.

For remote access, it's highly recommended to use SSH key-based authentication and to disable password-based logins to prevent brute-force attacks.

On the network side, your system's default firewalld firewall should be configured with a "default deny" policy, blocking all incoming connections unless you explicitly allow them.

Finally, for long-term security, implementing system monitoring with tools like the Linux Audit Daemon (auditd) and a file integrity monitor like Aide can help you detect suspicious activity or unauthorized changes to your system before they become major problems.

These measures, in conjunction with SELinux and your selected extensions, will contribute to system hardening.

 

[simmerskool]

SELinux is a powerful security tool, but it's just one part of keeping your Fedora system safe.
[snip]
These measures, in conjunction with SELinux and your selected extensions, will contribute to system hardening.

thanks I've done most or all of the above, and yes fedora has system & software updates nearly every day. I have used lynis (free) to harden with chatgpt suggestions and various comments mentioned here at MT.

 

[ForgottenSeer 123960]

thanks I've done most or all of the above, and yes fedora has system & software updates nearly every day. I have used lynis (free) to harden with chatgpt suggestions and various comments mentioned here at MT.

Yeah, hardening a system with Lynis is quite the task. Some of the suggestions are easy, but it gets tricky with the moderately challenging ones like hardening SSH or tuning kernel parameters. The more advanced stuff, like working with SELinux policies, custom scripting, or implementing advanced crypto settings, can definitely be overwhelming for new and intermediate users.