Quasar Linux RAT Developer Credential Theft | MSSP Advisory

A new Linux RAT called Quasar Linux RAT (QLNX) specifically targets developer systems to steal credentials and establish persistent access for supply chain attacks. The malware performs credential harvesting, keylogging, file manipulation, and network tunneling to compromise software development environments. QLNX aims to infiltrate the software supply chain by compromising developer and DevOps credentials.

Your RMM agents and remote access tools likely run on Linux endpoints in client developer environments, making them potential entry points for this RAT. When QLNX compromises a client's development pipeline, any software they build becomes a vector to spread malware to their customers, creating liability exposure for your advisory practice.

📬