A RAT, or remote access trojan, is a type of malware that lets attackers control a device from far away. Usually, RATs target Windows or macOS computers. But even Linux, which is known for being secure, is not completely safe from these kinds of threats.
A concerning case has popped up where malicious AUR packages on Arch Linux were found dropping CHAOS RAT onto user systems without their knowledge.
What's Happening: A user who goes by the name "danikpapas" uploaded three fake packages to the Arch User Repository (AUR)—librewolf-fix-bin, firefox-patch-bin, and zen-browser-patched-bin.
They looked like browser-related tools, but when installed, they ran a script that downloaded CHAOS RAT, a remote access trojan. Once inside, it gives attackers full control of the system, allowing them to run commands, spy on the user, and drop more malware.
The packages were up for around two days. They were first posted on July 16, 2025, and shortly flagged and removed by Arch maintainers on July 18, 2025.
What Now: If you use Arch Linux or an Arch-based distribution, check if any of these packages are installed on your system. Run this command to see if they’re there:
These screenshots are for illustrative purposes. I didn’t have those sus packages in my CachyOS installation.
If any show up, remove them immediately with:
sudo pacman -Rns <package-name>
As always, make sure your system is up to date and only install packages from trusted sources, particularly when using community-driven repositories like the AUR. Staying cautious helps keep your Linux setup safe.
Here's why you should opt for It's FOSS Plus Membership:
- Even the biggest players in the Linux world don't care about desktop Linux users. We do. - We don't put informational content behind paywall. Your support keeps it open for everyone. Think of it like 'pay it forward'. - Don't like ads? With the Plus membership, you get an ad-free reading experience. - When millions of AI-generated content is being published daily, you read and learn from real human Linux users. - It costs just $2 a month, less than the cost of your favorite burger.
Become a Plus Member today and join over 300 people in supporting our work.
Dimitrios
