Seven Malicious Go Packages Found Deploying Malware on Linux and macOS Systems

Summary: Cybersecurity researchers have identified a malicious campaign that targets the Go ecosystem using typosquatted modules, which deploy loader malware on Linux and macOS systems. The threat actor has published at least seven fraudulent packages that impersonate popular Go libraries, posing a risk to financial-sector developers. These packages exploit obfuscation techniques and rely on remote scripts to facilitate data theft or credential harvesting.

Affected: Go ecosystem and developers using the Go package repository

Keypoints :

• At least seven malicious Go packages have been identified, impersonating well-known libraries.
• The counterfeit packages contain code for remote code execution, enabling data theft and credential harvesting.
• The attack employs obfuscated shell commands and delayed execution to evade detection.