Arch Linux has temporarily disabled package adoption from its popular Arch User Repository (AUR) after a wave of malicious takeovers left users vulnerable to malware infections. The decision, announced by contributor Robin Candau on the distribution’s mailing list, aims to mitigate the spread of malware until a solution is found.
The issue stems from a two-stage infection campaign that began on July 29 with the package ‘openconnect-sso’. Researchers at the Independent Federated Intelligence Network (IFIN) have been tracking the campaign and reported that it shares similarities with a previous attack in June, which compromised over 400 AUR packages. The latest campaign involves a loader stage, designed to evade detection by checking for debuggers, sandboxes, virtual machines, and CI/CD environments before installing systemd services and cron jobs to ensure persistence.
The loader then downloads and launches a Tor client disguised as dbus-daemon to retrieve the second-stage payload from an ‘onion’ server. This stage is a Rust-based infostealer that targets browser credentials, cryptocurrency wallets, password manager data, cloud and developer secrets, AI service API keys, SSH keys, and messaging platform tokens. It also provides attackers with remote command execution over an encrypted Tor channel and can spread laterally by using stolen SSH keys to copy and execute itself on other systems.
The campaign has allegedly expanded to over 200 AUR packages, either through compromised maintainer accounts or by adopting orphaned packages. While the status of these packages has not been independently confirmed, a Reddit user tracking the campaign lists several popular AUR packages as potentially compromised. The Arch Linux project is urging users to report any suspicious adoption events or commits that haven’t been dealt with yet and stay vigilant.
The incident highlights the importance of maintaining robust security practices, particularly in open-source ecosystems like AUR. Users should exercise caution when installing packages from repositories like AUR, where vetting and verification processes may not be as stringent as those on official distribution channels. In fact, a recent report showed that 54% of successful attacks go undetected by security teams.
To mitigate such risks, users should test every layer before attackers do. By conducting regular breach and attack simulation tests, organizations can ensure their SIEM and EDR rules are effective in detecting threats that may otherwise slip through the cracks.
Source: Bleeping Computer — 2026-07-31