🎯 Process masquerading

The items that name it 3

• StyleSmuggler: Magento/Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
  writeup2026-09-05

  Backdoor disguises itself as [kworker/u:8:0], fc-cache, chronyd, sshd: apache@notty, -bash, [kworker/u16:2], [kstrp], [ksmd] to blend in with legitimate processes

• PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182
  writeup2025-12-10It is written here as Process masquerading (argv[0] and prctl PR_SET_NAME).

  PeerBlight overwrites argv[0] in memory and calls prctl(PR_SET_NAME, "[ksoftirqd]") to disguise itself as a legitimate kernel thread across tools like ps, top, and htop.

• Sysrv Infection (Linux Edition)
  writeup2024-04-14

  Binary runs under the name kthreaddk, a commonly observed identifier for this malware strain, to blend in with legitimate kernel threads