Phishing emails with RAR archives exploit Linux filename injection to deliver VShell backdoor, bypassing antivirus defenses ...

The second stage executes malicious macros that create a reverse shell on the target's system, which connects to the attacker's command and control (C2) server.

Regarding its operational capabilities, the malware uses either forkpty or pipes and a forked new process to set up a reverse shell for the attacker to remotely access the infected device. Sedexp ...