THE SILENT, FILELESS THREAT OF VSHELL

Summary from the TLDR InfoSec newsletter

Attackers embed base64-encoded Bash commands in RAR filenames that run automatically during directory listing with unsafe patterns like eval "echo $f" or for f in *. The attack downloads loaders specific to architecture that fetch XOR-encrypted VShell backdoor payloads, decrypts them in memory, and executes as fake kernel threads such as [kworker/0:2] to evade detection. This method bypasses defenses because antivirus doesn't scan filenames, the malware doesn't touch disk after decryption, and execution happens via common shell operations without needing executable permissions.