Arch Linux pulls three AUR packages that installed the CHAOS RAT

Arch Linux pulled three malicious AUR packages that installed the CHAOS Remote Access Trojan on users’ systems. The packages “librewolf-fix-bin”, “firefox-patch-bin”, and “zen-browser-patched-bin” were uploaded by user “danikpapas” and contained malware with a command and control server at 130.162[.]225[.]47:8080. Users who installed these packages should check for and delete the suspicious “systemd-initd” executable in their /tmp folder, as reported in the official security advisory. CHAOS is an open-source remote administration tool written in Go, and Acronis TRU tracked its evolution from Linux cryptomining campaigns to newer variants that hide their C2 configuration in a single Base64 string. Fittingly, the RAT’s own admin panel has holes too, such as the cross-site scripting flaw CVE-2024-31839 that lets a spoofed agent run scripts in the operator’s browser.