A newly disclosed toolkit called Furtex is drawing attention for packaging a wide range of post-exploitation, evasion, and telemetry-blinding techniques into a single project built around raw io_uring and eBPF operations.
The toolkit was publicly announced by MatheuZSecurity on July 19 as a Linux-focused evasion and post-exploitation framework that avoids liburing and higher-level frameworks in favor of direct syscalls.
Furtex is notable not just for its breadth but for how it organizes offensive research into operational categories that mirror real attackers’ tradecraft.
Based on the project description, the toolkit is divided into io_uring, bpf, ebpf, edrs, and techniques components, covering file and network operations, process injection, BPF map and program manipulation, EDR evasion, and Falco-specific bypass research.
Linux Furtex Toolkit Enables Process Injection
The project also emphasizes legal boundaries, stating that it is intended for authorized security research, red-team engagements, CTFs, and defensive tooling development rather than unauthorized access.
The most significant technical theme is Furtex’s use of io_uring as a stealth primitive. MatheuZSecurity has separately described io_uring as a high-performance asynchronous Linux interface that uses shared submission and completion rings.
That matters because the project argues many monitoring tools still depend heavily on syscall visibility, while io_uring can shift file and network activity into kernel workqueue paths that generate less conventional telemetry.
External analysis has also warned that malicious use of io_uring can sharply reduce per-syscall observability, complicating detection for EDR products that depend on syscall monitoring.
Within that model, Furtex includes capabilities for stealthy file access, reverse shell delivery, DNS-based exfiltration, and memory-resident execution, along with process injection options that rely on /proc/PID/mem, ptrace, and other Linux-native mechanisms.
The supplied project materials also describe tooling to bypass userland hooks, manipulate BPF maps, detach BPF links, suppress audit telemetry, and evade Falco’s default rules via alternate execution paths, event flooding, and process masquerading.
Rather than presenting a single rootkit, Furtex appears to function as a modular lab for testing how modern Linux defenses respond to low-level kernel-adjacent tradecraft.
The eBPF angle is equally important. Security reporting in 2026 has already highlighted how Linux threats are increasingly experimenting with eBPF and io_uring to hide processes, mask activity, and reduce telemetry without loading a conventional kernel module.
Furtex fits squarely into that trend by combining BPF-based reconnaissance and manipulation with userspace tooling designed to evade monitoring products, especially those that rely on hooks, tracepoints, audit events, or Falco-style behavioral rules.
For defenders, the release is less a proof of mass exploitation than a warning about where Linux offensive research is heading. Organizations monitoring sensitive Linux workloads should pay closer attention to unexpected io_uring usage, unusual BPF program or map activity, raw socket behaviors, and signs of audit or telemetry suppression.
Research around io_uring and eBPF continues to expand in both offensive and defensive directions, and Furtex shows how quickly those legitimate kernel features can be repurposed into a stealthy post-exploitation toolkit.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
