The **Arch Linux** project has taken the drastic step of temporarily disabling package adoption within its **Arch User Repository (AUR)**. This decision, announced by contributor **Robin Candau** on the distribution's mailing list, is a direct response to a significant uptick in malicious takeovers of existing **AUR** packages. ### Malicious Influx Prompts Immediate Action **Candau** stated, "Due to the current influx of malicious package adoptions and follow-up commits made via the **AUR**, package adoption is currently disabled while we are handling the situation." The project intends to re-enable the feature once a robust solution is implemented, urging users to report any suspicious activity. ### Campaign Details Emerge The **Independent Federated Intelligence Network (IFIN)** conducted a technical analysis, tracing the latest campaign's origins to July 29 with the `openconnect-sso` package. **IFIN** noted striking similarities to a previous attack in June, which saw over 400 **Arch Linux** packages compromised to distribute a Linux rootkit and info-stealer malware. ### A Two-Stage Infection Chain Researchers identified a sophisticated two-stage infection process in the recent attacks. The first stage acts as a loader, designed to evade detection by checking for debuggers, sandboxes, virtual machines, and CI/CD environments. It then establishes persistence through `systemd` services and `cron` jobs. This initial loader downloads and launches a **Tor** client, disguised as `dbus-daemon`, to retrieve the second-stage payload from a `.onion` server. ### Rust-Based Infostealer and RAT Capabilities The second-stage payload is a **Rust**-based infostealer. This potent malware targets a wide array of sensitive data, including browser credentials, cryptocurrency wallets, password manager data, cloud and developer secrets, **AI** service **API** keys, **SSH** keys, and messaging platform tokens. Beyond data exfiltration, the malware grants attackers remote command execution capabilities over an encrypted **Tor** channel. It also possesses **SSH** worm features, enabling lateral movement by using stolen **SSH** keys to self-propagate across other systems. ### Widespread Compromise Alleged A Reddit user tracking the campaign alleges that the malicious activity has expanded to over 200 **AUR** packages. This spread is reportedly occurring either through compromised maintainer accounts or by the adoption of orphaned packages. While specific confirmation is pending, popular packages like `boringssl-git`, `icloudpd`, `windscribe-cli-v2-bin`, `stirling-pdf-desktop-bin`, `openconnect-sso`, `arduino-language-server-noclang-bin`, and `pgadmin4-server` are among those reportedly affected. Users are advised to exercise extreme caution and verify the integrity of any **AUR** packages they install, given the ongoing threat.