MYRA RAT LD_PRELOAD persistence via libcache.so dropped by npm package

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects indicators of persistence via dynamic linker hijacking on Linux systems, specifically looking for the creation or usage of .libcache.so, modifications to /etc/ld.so.preload, hidden shell profile droppers, or node process execution utilizing LD_PRELOAD variables.