A sophisticated Linux malware called Koske, discovered in July 2025, hides malicious code within innocent-looking panda bear JPEG images to deploy cryptocurrency miners and establish persistent system access^[1]. Security researchers at AquaSec believe Koske was developed using artificial intelligence, based on its adaptive behaviors and code structure^[2].

The malware exploits misconfigured JupyterLab instances to gain initial access, then downloads two panda images containing separate payloads - a C-based rootkit and a shell script^[3]. Rather than using steganography, Koske employs polyglot files that function as both valid images and executable scripts^[1:1].

Once executed, the malware:

• Deploys CPU and GPU-optimized miners for 18 different cryptocurrencies
• Establishes persistence through cron jobs and systemd services
• Uses LD_PRELOAD to hide malicious processes and files
• Manipulates DNS settings and network configurations
• Automatically switches mining pools if one becomes unavailable^[1:2]

“Impersonation and psychological warfare will be a big thing in the coming years,” warns Rem Dudas from Palo Alto Networks, noting how AI enables malware to mimic other threat actors’ techniques^[4].