MYRA RAT Fileless Execution via npm: memfd_create + systemd-userdbd Masquerade

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects indicators of the MYRA Linux RAT, including process masquerading as systemd-userdbd, persistent modifications to system locations like /etc/profile.d/ and /usr/local/lib/, and malicious cron scheduling, typically originating from a Node.js process.