QLNX Credential Theft Targets Developers for Supply Chain Comprom

A novel and previously undocumented Linux threat, dubbed QLNX, has emerged, specifically targeting software developers and posing a direct risk to global supply chains. This credential theft malware, detailed in a

The attack begins long before any obvious sign of infection. QLNX executes entirely in memory, copies itself to a RAM-backed file, and then deletes its own binary from disk, leaving no trace on the hard drive.

The malware disguises its process using names that mimic normal Linux kernel threads, such as [kworker/0:0] or [migration/0], so even a careful administrator would not notice anything unusual.

Researchers from Trend Micro identified and analyzed QLNX after their AI-driven threat hunting platform flagged an unusual Linux implant with notably low detection rates. The team found that the malware carries embedded source code for both its rootkit and PAM backdoor inside the binary itself.

It compiles these components at runtime using the system’s own GCC compiler, then loads them through /etc/ld.so.preload to intercept system-wide activity.

What makes QLNX particularly alarming is its scope. It runs a multi-stage credential harvesting routine that sweeps SSH private keys, browser login databases, cloud configuration files for AWS and Kubernetes, Docker credentials, Git tokens, NPM tokens, PyPI API keys, and any .env files it finds.

All stolen data is sent to the attacker’s command-and-control server over an encrypted connection.

The malware also includes peer-to-peer mesh networking, so each infected system can relay commands to other compromised hosts, making eradication harder.

Organizations are advised to monitor for process names mimicking kernel threads, inspect /etc/ld.so.preload for unexpected entries, audit developer endpoints for suspicious shared library files, and review cloud credential stores after any suspected infection.

QLNX Targets Developers for Supply Chain Access

The most alarming aspect of QLNX is not what it does to a single machine, but what it enables downstream.

Developers are high-value targets because their credentials unlock publishing pipelines for packages used by thousands of users.

By stealing NPM and PyPI authentication tokens, QLNX gives its operator the ability to push malicious packages into trusted registries without raising immediate red flags.

Supply chain attacks through open-source ecosystems like PyPI and npm have become one of the most effective methods available to threat actors today.

A single compromised maintainer account could be used to trojanize a legitimate package, inject backdoors into build artifacts, or pivot into cloud environments where production infrastructure lives. The damage from one infected developer machine can be enormous.

The malware harvests SSH keys to move laterally to other servers in the user’s known host chain. This means the initial compromise can quietly spread to cloud instances and CI/CD pipelines long before anyone detects a problem.

QLNX’s ability to wipe system logs including auth.log, syslog, and bash_history makes forensic investigation significantly harder after the fact.

Stealth, Persistence, and PAM Backdoor

QLNX goes to exceptional lengths to remain hidden and survive reboots. It registers persistence through systemd services, crontab reboot entries, init.d scripts, and modifications to the user’s .bashrc file. Even if one persistence method is removed, the others ensure the malware restarts automatically, making full eradication genuinely difficult.

The PAM backdoor is one of QLNX’s most technically sophisticated components. PAM, or Pluggable Authentication Module, handles logins on Linux systems. QLNX injects a malicious PAM module that intercepts credentials in plaintext the moment a user authenticates, then stores captured passwords in a hidden log file at /var/log/.ICE-unix using XOR-encrypted logging.

The eBPF-based kernel rootkit hides the malware’s process IDs, file names, and network ports at the kernel level, making standard tools like ps, top, or netstat ineffective.

The combination of in-memory execution, log wiping, and PAM interception creates a threat that is difficult to detect even on monitored systems. Organizations running Linux developer environments should treat this as an urgent concern and review their endpoint visibility practices immediately.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.