Offensive eBPF: The Kernel as Your Backdoor

eBPF rootkit mechanics, PAM credential harvesting via uprobes, process and connection hiding via getdents64 hooks, XDP magic-packet backdoor, and nation-state deployments