Quasar Linux RAT Targets Developers With Fileless Execution and eBPF Rootkit

Cybersecuritynews •Tushar Subhra Dutta • May 26, 2026

A newly discovered Linux malware known as Quasar Linux, or QLNX, is actively targeting software developers and DevOps engineers with a level of sophistication rarely seen in Linux-focused threats. Unlike most malware that relies on files stored on disk, QLNX runs almost entirely in memory, making it very difficult for traditional security tools to detect. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Quasar Linux RAT Targets Developers with Advanced Fileless Attacks Quasar Linux (QLNX) is a newly identified Remote Access Trojan specifically targeting software developers and DevOps engineers. It employs sophisticated techniques such as fileless execution, an eBPF rootkit, and PAM backdoors to infiltrate systems, making detection challenging for traditional security measures. The malware operates primarily in memory, avoiding file storage, which is a common detection vector. Its peer-to-peer command and control (C2) mesh further complicates mitigation efforts. The attacks are indicative of a growing trend in targeting the software supply chain, posing significant risks to organizations reliant on Linux systems. Current reports indicate that the malware is actively being exploited, emphasizing the need for heightened security awareness among affected professionals. 2 sources 67

Extracted Entities

Quasar Linux RAT Targets Developers With Fileless Execution and eBPF Rootkit

The full story

Extracted Entities

Attack Types (1)

Malware (3)

Platforms (1)