ChillyHell Malware Shell Profile Injection

Kaung Khant Ko@kaungkhantko

•updated Sep 23, 2025•3•0•238

Detects modification of shell profile files (.zshrc, .bash_profile, .profile) by processes named 'applet' or 'qtop'. This is a fallback persistence mechanism used by the ChillyHell malware.