Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers Emerge

The Hacker News reports a concerning week for defenders, highlighting a Linux rootkit, a macOS crypto stealer, and the persistent threat of WebSocket skimmers. This recap underscores a recurring theme: attackers are leveraging both novel techniques and exploiting long-standing, unpatched vulnerabilities. The report details instances of poisoned trusted downloads and cloud servers being compromised, indicating a broad attack surface and a lack of fundamental security hygiene.

Attackers are clearly finding success by targeting known weaknesses and supply chain vectors. The mention of “bugs that should’ve died years ago” speaks volumes about the industry’s struggle with basic patch management and configuration. The attacker’s calculus remains simple: exploit the path of least resistance. Whether it’s a zero-day or a decade-old CVE, if it grants access, they’ll use it.

This isn’t sophisticated nation-state tradecraft in every case; sometimes it’s simply an opportunistic attacker stumbling into root access. The common thread is that these opportunities exist because organizations fail to implement foundational security controls and maintain their infrastructure. The consequence is predictable: compromised systems, data theft, and the ongoing erosion of trust.