Plague

Plague is a Linux backdoor that operates by installing a malicious Pluggable Authentication Module (PAM), reportedly targeting the SSH authentication stack. By embedding itself in PAM, it can bypass normal authentication checks and provide covert persistent SSH access on compromised systems. Because PAM modules execute within privileged authentication processes, Plague gains a highly sensitive position in the login flow and can survive ordinary application updates.

The malware is associated with Linux environments and requires elevated privileges for installation, indicating it is most likely used after an attacker has already obtained administrative access through another intrusion path. Public reporting describes its initial infection vector as unknown. Detection engineering references also indicate variants tied to credential theft, consistent with the broader risks of PAM abuse in which authentication material can be exposed during processing.

Plague is notable as one of the earlier known Linux backdoors focused specifically on the PAM stack and has been cited as a predecessor to later PAM-based implants such as PamDOORa. It has been characterized as capable of evading traditional antivirus detection for an extended period. The malware illustrates how adversaries can abuse Linux authentication infrastructure to achieve stealthy persistence and unauthorized remote access on servers, especially systems exposing SSH services.