MYRA RAT - /etc/ld.so.preload Modified to Register Malicious libcache.so

Ethan Andrews@eandrews

•updated Jun 22, 2026•0•0•5

Detects modification of /etc/ld.so.preload to register the MYRA RAT rootkit shared library (.libcache.so) for system-wide LD_PRELOAD injection. The MYRA npm package (apintergrationpost) copies libcache.so to /usr/local/lib/.libcache.so and appends its path to /etc/ld.so.preload, causing the rootkit to load into every new process on the system.