A sophisticated Linux rootkit dubbed PoisonedRefresh is targeting F5 BIG-IP Access Policy Manager (APM) environments, using advanced Linux and Apache hooking techniques to inject a fileless PHP web shell directly into memory while leaving legitimate PHP files on disk untouched. Sophos assesses the malware as a likely second-stage payload deployed following exploitation of CVE-2025-53521, a critical remote code execution (RCE) vulnerability in F5 BIG-IP, with an unidentified installer or propagation component modifying the Apache /usr/sbin/httpd executable, altering SELinux configurations, and establishing persistence across BIG-IP upgrades. Once Apache starts, the rootkit intercepts __libc_start_main and the Apache Portable Runtime module loader to hook PHP operations, dynamically injecting its web shell into legitimate BIG-IP APM webtop scripts such as apm_css.php3, full_wt.php3, and webtop_popup_css.php3. Attackers can send specially crafted requests that are decrypted and executed through PHP’s eval() function, with results returned as HTTP 201 responses disguised as CSS content, helping conceal malicious activity. The implant also establishes a password-protected local UNIX socket capable of launching an interactive Bash shell without exposing a TCP listening port and deliberately delays backdoor initialization to blend into normal Apache activity. Defenders should investigate Apache processes accessing /proc/self/maps, changes to libphp memory protections, creation of /run/bigtlog.pipe, unexpected /bin/bash execution, and unusual POST requests or HTTP 201 text/css responses involving the targeted .php3 endpoints. The Shadowserver Foundation reportedly identified 795 internet-exposed BIG-IP APM endpoints vulnerable to CVE-2025-53521, highlighting the potential attack surface for environments that remain unpatched. CTIX analysts will continue to report on novel and interesting tactics, techniques and procedures.