The Pakistani APT36 cyberspies are using Linux .desktop files to load malware in new attacks against government and defense entities in India.

The activity, documented in reports by CYFIRMA and CloudSEK, aims at data exfiltration and persistent espionage access. APT 36 has previously used .desktop files to load malware in targeted espionage operations in South Asia.

The attacks were first spotted on August 1, 2025, and based on the latest evidence, are still ongoing.

Desktop file abuse

Although the attacks described in the two reports use different infrastructure and samples (based on hashes), the techniques, tactics and procedures (TTPs), attack chains, and apparent goals are the same.

Victims receive ZIP archives through phishing emails containing a malicious .desktop file disguised as a PDF document, and named accordingly.

Linux .desktop files are text-based application launchers that contain configuration options dictating how the desktop environment should display and run an application.

Users open the .desktop file thinking it’s a PDF, which causes a bash command hidden in the ‘Exec=” field to create a temporary filename in “/tmp/’ where it writes a hex-encoded payload fetched from the attacker’s server or Google Drive.

Then, it runs ‘chmod +x’ to make it executable and launches it in the background.

To lower suspicion for the victim, the script also launches Firefox to display a benign decoy PDF file hosted on Google Drive.

In addition to the manipulation of the ‘Exec=” field to run a sequence of shell commands, the attackers also added fields like “Terminal=false’ to hide the terminal window from the user, and ‘X-GNOME-Autostart-enabled=true’ to run the file at every login.

Typically, .desktop files on Linux are plain-text shortcut files, defining an icon, name, and command to execute when the user clicks it.

However, in APT36 attacks, the attackers abuse this launcher mechanism to turn it essentially into a malware dropper and persistence establishment system, similarly to how the ‘LNK’ shortcuts are abused on Windows.

Because .desktop files on Linux are typically text, not binaries, and as their abuse isn’t widely documented, security tools on the platform are unlikely to monitor them as potential threats.

The payload dropped by the malformed .desktop file in this case is a Go-based ELF executable that performs espionage functions.

Although packing and obfuscation made analysis challenging, the researchers found that it can be set to stay hidden, or attempt to set up its separate persistence using cron jobs and systemd services.

Communication with the C2 is made through a bi-directional WebSocket channel, allowing data exfiltration and remote command execution.

Both cybersecurity firms find this latest campaign to be a sign of the evolution of APT36’s tactics, which are turning more evasive and sophisticated.

The Clear Linux OS team has announced the shutdown of the project, marking the end of its 10-year existence in the open-source ecosystem.

Clear Linux is a Linux distribution developed and maintained by Intel, featuring aggressive optimizations for Intel hardware. Binaries are compiled using tuning flags designed explicitly for Intel CPUs.

It was a minimalist, modular OS that utilized software bundles for faster app installation and automatic performance tuning for optimal speed and power efficiency.

The distribution was primarily aimed at software developers, performance enthusiasts, and those working in cloud or server environments.

In an announcement to the Clear Linux forums, the team says the project will no longer receive security patches or any other updates. Therefore, its user base should migrate to other distributions for safety.

“Effective immediately, Intel will no longer provide security patches, updates, or maintenance for Clear Linux OS, and the Clear Linux OS GitHub repository will be archived in read-only mode,” reads the announcement.

“So, if you’re currently using Clear Linux OS, we strongly recommend planning your migration to another actively maintained Linux distribution as soon as possible to ensure ongoing security and stability.”

Although Intel has not officially explained why it’s shutting down the project, it could be due to low user adoption coupled with a high maintenance burden.

Considering that Clear Linux OS relied on its own package management and update system, as it is not a fork of another distribution, it required substantial engineering resources to provide user support.

Another key point may be Intel’s ongoing efforts to consolidate and tighten its operations, scaling back niche internal projects that don’t provide strategic value, and focusing more on new targets, such as agentic AI.

Although Clear Linux OS is now abandoned, the team behind it says it will remain invested in the Linux ecosystem and continue to provide Intel hardware optimizations that can be applied to other distributions and open-source software.

If you rely on Clear Linux OS, you are recommended to migrate to another distribution as soon as possible, as the lack of updates means the system will become vulnerable to flaws with known/public exploits in a short time.

A new campaign employing ClickFix attacks has been spotted targeting both Windows and Linux systems using instructions that make infections on either operating system possible.

ClickFix is a social engineering tactic where fake verification systems or application errors are used to trick website visitors into running console commands that install malware.

These attacks have traditionally targeted Windows systems, prompting targets to execute PowerShell scripts from the Windows Run command, resulting in info-stealer malware infections and even ransomware.

However, a 2024 campaign using bogus Google Meet errors also targeted macOS users.

ClickFix targeting Linux users

A more recent campaign spotted by Hunt.io researchers last week is among the first to adapt this social engineering technique for Linux systems.

The attack, which is attributed to the Pakistan-linked threat group APT36 (aka “Transparent Tribe”), utilizes a website that impersonates India’s Ministry of Defence with a link to an allegedly official press release.

When visitors click on this website link, they are profiled by the platform to determine their operating system, and then redirected to the correct attack flow.

On Windows, victims are served a full-screen page warning them of limited content usage rights. Clicking on ‘Continue’ triggers JavaScript that copies a malicious MSHTA command to the victim’s clipboard, who is instructed to paste and execute it on the Windows terminal.

This launches a .NET-based loader which connects to the attacker’s address, while the user sees a decoy PDF file to make everything appear legitimate and as expected.

On Linux, victims are redirected to a CAPTCHA page that copies a shell command to their clipboard when clicking the “I’m not a robot button.”

The victim is then guided to press ALT+F2 to open a Linux run dialog, paste the command into it, and then press Enter to execute it.

The command drops the ‘mapeal.sh’ payload on the target’s system, which, according to Hunt.io, does not perform any malicious actions in its current version, limited to fetching a JPEG image from the attacker’s server.

“The script downloads a JPEG image from the same trade4wealth[.]in directory and opens it in the background,” explains Hunt.io.

“No additional activity, such as persistence mechanisms, lateral movement, or outbound communication, was observed during execution.”

However, it is possible that APT36 is currently experimenting to determine the effectiveness of the Linux infection chain, as they would just need to swap out the image for a shell script to install malware or perform other malicious activity.

The adaptation of ClickFix to carry out attacks on Linux is another testament to its effectiveness, as the attack type has now been used against all three major desktop OS platforms.

As a general policy, users should not copy and paste any commands into Run dialogs without knowing exactly what the command does. Doing so only increases the risk of a malware infection and theft of sensitive data.

Trusted Editorial content, reviewed by leading industry experts and seasoned editors. Ad Disclosure

Cardano has become the newest member of the Linux Foundation’s Confidential Computing Consortium (CCC), a move that positions the open-source blockchain alongside heavyweights such as Microsoft and Amazon in the fast-growing market for hardware-based data-protection standards. The announcement emerged during an hour-long “Midnight Booth” fireside chat at Consensus, where Charles Hoskinson, chief executive of Input Output (IO), and Eran Barak, chief executive of the Midnight development company, sketched out how confidential computing will anchor Cardano’s privacy-first sidechain, Midnight.

“We just recently joined the Confidential Computing Consortium, you know, with Linux Foundation, and we’re right there with Microsoft and Amazon with Nitro. They’re talking about confidential computing and trusted hardware enclaves with GPUs for outsourcing AI data,” Hoskinson told the audience. The CCC sets cross-industry specifications for enclave-based security; its membership signals that Cardano intends to align Midnight’s zero-knowledge roll-ups and decentralized-identifier (DID) stack with emerging hardware standards rather than rely solely on purely cryptographic shields.

“So, Midnight basically clicks into all of those different things and it gives you the ability to reason and think about how do I share, who do I share with, what do I own, what do they own, what’s the semantical value of the data that I’m sculpting, and then ultimately what’s the marketplace look like and how do I be an economic agent in that marketplace and I actually get paid for sharing these things as opposed to it all goes to the Magnificent Seven and they just tell me what I get,” Hoskinson added.

Cardano Takes Next Step In Secure Blockchain

Hoskinson traced Midnight’s origins to “a bar in Tel Aviv” during Eurocrypt 2018, describing how a late-night debate about zero-knowledge proofs eventually matured into a sidechain that combines a programmable Stark-based execution engine (“Kachina”), a dual-token economic model (“Knight” for governance and “dust” for metered capacity) and selective-disclosure controls rooted in W3C DIDs. Yet, according to Barak, technological ingenuity alone is not enough; enterprise adoption hinges on hardware-rooted trust. Confidential computing, he said, supplies that final layer.

“When you think about protecting your data, you really need to think about two pieces—protecting the data itself and protecting the metadata,” Barak explained. “Midnight hopes to be the fabric that enables AI to access personal private data in the right way that doesn’t violate our rights.” By joining the CCC, Cardano gains a seat at the table where those fabric threads are woven into chipset specifications, enclave attestation protocols and open-source reference code.

Much of the session focused on Midnight’s two-asset design, which separates volatile, value-accruing governance (“Knight”) from a stable, non-speculative capacity unit (“dust”). Hoskinson argued that splitting consensus incentives from fee predictability sidesteps the tension regulators see in fully shielded currencies such as Monero. “You get your cake and eat it, too… developers can pay in Bitcoin or Ether or Solana through a capacity exchange, and the end user doesn’t notice that they’re using a different system.”

Confidential computing extends that logic to the hardware layer. Enclave-sealed execution protects wallet keys, zero-knowledge circuits and DID registries from side-channel attacks, while at the same time furnishing auditors with cryptographic attestation that regulatory conditions embedded in smart-contract templates are being met. “Selective disclosure is an absolute necessity,” Hoskinson told a questioner who raised compliance fears. “You bake in the capacity to put disclosure at the smart-contract level and then let exchanges decide their suitability guidelines on a case-by-case basis.”

Cardano’s CCC membership arrived as the conversation turned to tokenized real-world assets—a market Hoskinson sized at “ten plus trillion dollars” today and “a hundred trillion” once small-cap and frontier-market issuers join. Midnight, he maintained, must interoperate with both legacy venues such as the New York Stock Exchange and on-chain liquidity pools. Hardware-verified privacy makes that bridging credible. “You want broker-dealers, compliance, circuit breakers, but you also want blockchain stuff… having infrastructure like Midnight is the only way to really do that,” he said.

Barak reported more than 2,000 early builders on Midnight’s testnet, ranging from dark-pool prototypes and medical-record pilots to carbon-credit tracing for jet engines. Because code and state are encrypted, IO’s own developer-relations team cannot inspect what is being deployed; teams volunteer information only in opt-in calls. “I think if we finally bring blockchain technology that encompasses the privacy elements businesses need, the innovation is just unbelievable,” Barak remarked.

At press time, ADA traded at $0.68.

Featured image created with DALL.E, chart from TradingView.com

Editorial Process for bitcoinist is centered on delivering thoroughly researched, accurate, and unbiased content. We uphold strict sourcing standards, and each page undergoes diligent review by our team of top technology experts and seasoned editors. This process ensures the integrity, relevance, and value of our content for our readers.