Phishing emails with RAR archives exploit Linux filename injection to deliver VShell backdoor, bypassing antivirus defenses ...

The second stage executes malicious macros that create a reverse shell on the target's system, which connects to the attacker's command and control (C2) server.