Cyber Intelligence

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Medium Severity Global
Date Occurred Jun 12, 2026 19:33 UTC
Event Type Cyber Intelligence
Source TheHackerNews
Recorded Jun 12, 2026
Full Description

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a

Event Metadata
  • ID #8125
  • Type Cyber Intelligence
  • Region Global
  • Severity Medium
  • Indexed Jun 12, 2026