New stealthy Quasar Linux malware targets software developers
2026-05-06T07:23:34Z•bab0f3917cb74f370ed1dfd17b8ae51367f8114248161fef6dc5e98db3b8610e
APT37AndroidCVE-2026-22679FTCInstructureKochavaMicrosoft-Phone-LinkPyPISMS-OTP-theftTrellixVimeoWeaver-E-cologybackdoorcredential-stealercredential-theftdata-breachlinuxlocation-privacymalwarephishing-abuserootkitsupply-chaintrojanized-installer
What happened
Multiple high-impact security incidents and malware campaigns were reported: a new Linux implant named Quasar Linux (QLNX) targeting software developers with rootkit, backdoor, and credential-stealing capabilities; DAEMON Tools installers trojanized in a supply-chain attack delivering a backdoor since April 8; CloudZ RAT now includes a Pheno plugin that abuses Microsoft Phone Link to steal SMS/OTPs; a backdoored PyTorch Lightning PyPI package drops a credential stealer; APT37/ScarCruft pushed BirdCall Android malware via a game platform; Weaver E-cology’s critical vulnerability (CVE-2026-22679
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- bab0f3917cb74f370ed1dfd17b8ae51367f8114248161fef6dc5e98db3b8610e
- Enrichment time
- 2026-05-06T07:23:34Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.