MYRA Linux RAT Fileless Execution via memfd_create Masquerading as systemd-userdbd

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects Node.js processes ('node' or 'node.exe') spawning other processes or executing commands that reference suspicious file paths, such as '.libcache.so' or '.sh.local', or utilizing risky syscall patterns like 'memfd_create' or 'fexecve'. This pattern is often associated with malicious npm post-install scripts or supply chain attacks.