rfxn.com maldetect-current.tar.gz (v1.6.6) is trojanized, ships a root "cve-2026-41940" payload + cdn.rfxn.com beacon that are NOT in this repo

[PumaTheThe]

Summary

The maldet tarball currently served from https://www.rfxn.com/downloads/maldetect-current.tar.gz contains code that does not exist in this GitHub repository. install.sh silently executes a bundled script as root on install/upgrade, and a bundled host_meta beacons a host fingerprint to cdn.rfxn.com. This appears to be a compromise of the rfxn.com distribution channel (or build pipeline), since the official source tree here is clean.

Discovered while installing maldet on a server. The payload is cPanel-gated, so it did not execute on my host.

Affected artifact

URL	https://www.rfxn.com/downloads/maldetect-current.tar.gz
Version	1.6.6
Tarball SHA-256	76f1d260dac5e0bb3ca487f8d3e119655196de87b08ec89dfd73155e083feb5d

Injected files (mtimes inside the archive — May 2026):

• files/internals/cve-2026-41940 — 12,537 bytes, 2026-05-13
• files/internals/host_meta — 7,328 bytes, 2026-05-13
• install.sh — 6,487 bytes, 2026-05-10 (carries the hidden invocation block)

Proof it is injected (not from this repo)

Checked against github.com/rfxn/linux-malware-detect master:

• install.sh → 0 references to cve-2026-41940 or suspendreseller
• files/internals/cve-2026-41940 → HTTP 404 (does not exist)
• files/internals/host_meta → HTTP 404 (does not exist)

The hidden block in the tarball's install.sh

# CVE-2026-41940 - one-shot cPanel defensive remediation (sentinel-gated)
if [ -e /usr/local/cpanel/cpanel ] \
   && [ ! -e $inspath/cve-2026-41940.done ] \
   && [ -f $inspath/internals/cve-2026-41940 ]; then
        chmod 750 $inspath/internals/cve-2026-41940
        ( bash $inspath/internals/cve-2026-41940 ) >> /dev/null 2>&1 || true
fi

What internals/cve-2026-41940 does (as root, output suppressed)

• kill -9s processes whose exe is /root/sshd, nuclear.*, or /root/.local/bin/system-service; quarantines the files
• Auto-suspends a cPanel reseller: whmapi1 suspendreseller user=sptadm when the domain 4ef72197.cpx.local + sptadm account are present
• Disables/quarantines a dbus-broker-helper.service unit, /etc/udev/rules.d/89-cdrom-id-helper.rules, /tmp/seobot.zip, and xmrig miner paths
• Arms a sentinel /usr/local/maldetect/cve-2026-41940.done

It is styled to look like legitimate one-shot vendor IR (GPL/R-fx headers, fingerprint-gating, sentinel-arming), which makes it more concerning, not less.

internals/host_meta (telemetry / beacon)

Builds:

lmd_referer="LMD:<ver>:<hostid>:<os>:cp<Y/N>:b<build>:c<compromise>:r<remediated>"

…encoding OS family, cPanel presence, an IOC/"compromise" fingerprint (checks for sptadm, xmrig, dbus-broker-helper, system-service, etc.) and the remediation-sentinel state — and sends it to cdn.rfxn.com during signature updates.

Reproduction

# 1) Confirm the injected files are present in the served tarball
curl -s https://www.rfxn.com/downloads/maldetect-current.tar.gz \
  | tar tz | grep -E 'internals/(cve-2026-41940|host_meta)'

# 2) Extract and READ (do NOT run install.sh)
curl -s -o /tmp/lmd.tgz https://www.rfxn.com/downloads/maldetect-current.tar.gz
mkdir -p /tmp/lmd && tar xzf /tmp/lmd.tgz -C /tmp/lmd --strip-components=1
grep -n 'cve-2026-41940' /tmp/lmd/install.sh
sed -n '1,60p' /tmp/lmd/files/internals/cve-2026-41940

# 3) Compare to the clean GitHub source (these return 404)
curl -s -o /dev/null -w '%{http_code}\n' \
  https://raw.githubusercontent.com/rfxn/linux-malware-detect/master/files/internals/cve-2026-41940
curl -s -o /dev/null -w '%{http_code}\n' \
  https://raw.githubusercontent.com/rfxn/linux-malware-detect/master/files/internals/host_meta

Impact

Anyone installing maldet from the rfxn.com tarball right now runs the injected root code. On cPanel hosts it will kill processes, quarantine files, and suspend a reseller account (sptadm) with no prompt or consent; all hosts beacon a fingerprint to cdn.rfxn.com.

Note: the official, documented install path, git clone https://github.com/rfxn/linux-malware-detect.git && cd linux-malware-detect && ./install.sh — installs the clean source and is not affected. Only the rfxn.com tarball is.

---

Reported after discovering this on a shared hosting server during a routine maldet install. Payload artifacts preserved offline for inspection.