Found a backdoor on my NixOS laptop disguised as a "Nix-update" service?
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A NixOS user reports finding a 12 MB Go binary and systemd user units in their home directory, which reverse-engineering suggests is a customized ligolo-ng build with obfuscation and a C2 domain, installed silently on October 22. ClamAV did not flag it.