yeet-src/poolnarc

Behavioral hidden-cryptominer detector for Linux in eBPF — flags processes talking to mining-pool ports while spoofing kernel-thread names. No signatures, no agent, no cloud. CO-RE portable.

5 best points · 1 comments · 1 Hacker News post · 6 GitHub stars · View on GitHub

Hacker News discussions

• Show HN: Poolnarc – catch hidden Linux cryptominers from two eBPF hooks (5 points, 1 comments, by r3tr0, 2026-06-01)