ShadowHS Malware Framework Targets Linux Systems with Fileless Techniques

The ShadowHS malware framework has been identified as a significant threat to Linux environments, utilizing a fileless architecture for stealthy operations. Discovered by Cyble Research & Intelligence Labs on January 30, 2026, ShadowHS employs a multi-stage encrypted loader for in-memory execution, enabling attackers to perform credential theft, privilege escalation, and data exfiltration without leaving persistent files on the system.