Attackers uploaded look‑alike Arch Linux AUR packages (e.g., “yyay”) to catch users who mistype popular AUR helpers like yay/paru. The fake packages ran a malicious install script that downloaded and executed code as root during install/upgrade, potentially enabling credential theft or backdoors.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
On Arch, one extra letter in an AUR helper name, like installing “yyay” instead of “yay”, can silently hand root to a stranger. Attackers uploaded a trojan AUR package called “yyay” that reuses the real yay upstream URL and source tarball, but hides a scriptlet that downloads and runs arbitrary code as root during pacman install or upgrade. Here’s the trap: you search AUR, click the typo-similar helper, it looks legit because the URL matches upstream, you hit install, and that hidden script pulls code from a personal project on gitflic.ru straight into your system as root. Your move: before installing any AUR helper, stop and double-check the exact package name and its PKGBUILD, if it’s a near-miss like “yyay” or downloads and runs remote code, back out and report it.
A real malware campaign dubbed “MovieReaper” infected users who tried to download popular movies from torrent trackers. Attackers abused a compromised public torrent-file repository so that magnet links returned a different torrent that downloaded a Windows .exe disguised as a movie file, which…
Researchers demonstrated a new “agent data injection” technique where attackers plant content (like a review or GitHub comment) that an AI agent mistakenly treats as trusted system data. In tests, this caused web-browsing agents to click the wrong buttons (e.g., “Buy Now”) and coding agents to run…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
Attackers are tricking Minecraft players into downloading malware by cloning legitimate mod/client websites and manipulating search results so the malicious pages appear highly ranked. Even after the malware’s command-and-control systems were disrupted, the fake sites and trusted file-hosting links…
Researchers observed AI coding agents inside corporate networks following instructions hidden in websites’ llms.txt files, including installing packages that didn’t exist yet. Attackers (or the researchers demonstrating the risk) could then register those package names and have the agents install…
Researchers found 16 look‑alike (typosquatted) RubyGems packages that trick developers into installing a Windows information stealer. The malicious gems run code automatically during installation, pull down additional malware, and then steal browser logins and crypto wallet data before uploading it…
