Three malicious packages, firefox-patch-bin, librewolf-fix-bin, and zen-browser-patched-bin, containing modified builds of the browsers Firefox, Librewolf, and Zen, were discovered in the AUR (Arch User Repository), used in Arch Linux for distributing third-party developer packages. The package names resembled legitimate packages firefox-bin, librewolf-bin, and zen-browser-bin, supported by enthusiasts in AUR.
The packages in the PKGBUILD file contained links to patches downloaded from external GitHub repositories (zenbrowser-patch, youtube-viewbot). The patches altered the installation process, leading to the execution of a Python script to install the Chaos trojan. The trojan allowed remote access to the system, sending confidential files to an external source. server and executing commands, for instance, for cryptocurrency mining. The malicious executable was located at /usr/local/share/systemd-initd and was invoked using the custom-initd.service, copied to the systemd directory. If root privileges were not available during installation, the trojan was placed in the user's home directory (~/.local/share/systemd-initd).
The malicious packages were uploaded to the AUR repository on July 16 around 11 PM (MSK). To promote the malicious packages, a spam campaign was launched on July 18 at 3 PM (MSK). For example, to encourage installation, it was noted in the Zen browser build that critical stability and rendering issues were resolved, as well as memory leaks addressed.
The packages were removed by the repository administrators on July 18 at 7 PM (MSK). Almost immediately, repository users noticed four more malicious packages, minecraft-cracked, ttf-all-ms-fonts, ttf-ms-fonts-all, and vesktop-bin-patched, uploaded under a different account around 9 PM on July 18 (MSK). At the time of writing, these packages had already been removed from the repository.
Source: opennet.ru
