A security audit by Companion Sentinel uncovered GFSHELL, a sophisticated polymorphic malware that bypassed billion-dollar security scanners on 1000+ servers. The attack used a two-stage process: a 'Factory' script to fingerprint server configurations and a 'Polymorphic Gateway' that evaded detection by injecting comments into function calls (e.g., shell_exec/auth/). This technique breaks standard regex signatures used by traditional security tools.

Companion Sentinel detected the threat using recursive heuristic scanning that identifies the evasion 'DNA' rather than static signatures, combined with behavioral analysis of anomalies like shell history wiping and unauthorized crontab modifications. This incident highlights the critical need for high-fidelity auditing and behavioral detection over static perimeter defenses.