eBPF rootkits: uprobe on libpam.so = cleartext creds from every sudo/ssh/VPN with zero binary modification. XDP at the NIC driver = full firewall bypass before iptables processes the packet. BPFDoor in production against telecoms since 2021. ShadowGuard hit 70+ orgs in 37 countries in Feb 2026. https://www.kayssel.com/newsletter/issue-55/ #infoSec #cyberSecurity #Pentesting #BugBounty #Offsec #Linux #ebpf