AI-Forged Panda Images Hide Persistent Cryptomining Malware ‘Koske’

A new Linux malware strain named Koske is delivering cryptomining payloads through dropper files disguised as benign panda images. The malware campaign leverages AI-generated code and weaponized panda JPEGs to deploy stealthy and persistent rootkits designed for cryptomining. According to Aqua Nautilus, the cybersecurity team at Aqua Security, Koske likely uses AI assistance, as its code appears shaped by large language models (LLMs). Aqua researcher Assaf Morag described Koske as “a sophisticated Linux threat” showing clear signs of AI-assisted development, representing a new breed of persistent and adaptable malware built specifically for cryptomining.

Initial Access and Delivery via Panda Images

The attack begins by exploiting a misconfigured JupyterLab instance, allowing attackers to download two polyglot JPEG files from a shortened URL. These files are regular images with appended executable payloads. Morag explained that the initial access originated from a Serbian IP address exploiting unauthenticated JupyterLab instances exposed to the internet—a common but risky practice. Weak passwords and known remote code execution (RCE) vulnerabilities also contribute to such compromises. One possible entry point is CVE-2025-30370, a high-severity vulnerability in the JupyterLab-git extension that allows command injection. When executed, the panda images extract and run malicious C code and shell scripts directly in memory, bypassing traditional antivirus detection by never writing the payloads to disk. The files blend image data with executable shellcode, making detection difficult.

Modular Payload for Stealth and Persistence

Koske employs multiple tactics to maintain stealth and persistence:

It hijacks hidden Bash shell configuration files to execute custom system scripts that maintain communication with command-and-control (C2) servers.
The rootkit, written in C, hooks the readdir() system call to hide processes and files named “Koske” or “hideproc.”
It registers itself as a background service and sets up recurring scheduled tasks.
The malware uses adaptive logic, including proxy-checking routines and intelligent selection among 18 different cryptocurrency miners, with fallback behaviors likely borrowed from AI functions.

AI-forged panda images hide persistent cryptomining malware ‘Koske’