Loading story…
Researchers reported a Go supply-chain attack in which a malicious module, github[.]com/xinfeisoft/crypto, impersonates the widely trusted golang.org/x/crypto codebase (and its GitHub mirror) to blend into developer dependency graphs via namespace confusion. The module was publicly listed on pkg.go.dev as v0.15.0 and replicated the legitimate repository’s structure and subpackages (e.g., bcrypt, argon2, ssh) to reduce suspicion during review.
The backdoor was embedded in ssh/terminal/terminal.go by modifying the ReadPassword helper so that, during interactive password entry, it captures credentials in plaintext and writes them to /usr/share/nano/.lock, then contacts attacker-controlled resources for follow-on actions. Reported post-compromise behavior includes fetching an “update” pointer hosted on GitHub, exfiltrating the harvested password to an attacker endpoint, downloading and executing a shell script stager, appending an attacker SSH key to /home/ubuntu/.ssh/authorized_keys, changing iptables default policies to ACCEPT, and downloading additional payloads from img[.]spoolsv[.]cc disguised with a .mp5 extension; analyzed payloads (e.g., sss.mp5, 555.mp5) were identified as the Rekoobe Linux backdoor.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
After Socket reported the package, the Go security team blocked the module on the public Go module proxy, which began returning a 403 SECURITY ERROR response for the package.
Researchers disclosed that the module fetched a shell script that added an attacker SSH key, set iptables default policies to ACCEPT, downloaded staged payloads disguised as .mp5 files, and ultimately deployed the Rekoobe Linux backdoor with traffic observed to 154.84.63.184:443.
Socket's Threat Research Team identified github.com/xinfeisoft/crypto as a malicious lookalike Go module that backdoored ssh/terminal/terminal.go to capture passwords entered through ReadPassword and exfiltrate them via attacker-controlled infrastructure.
Socket reported it could still retrieve the malicious github.com/xinfeisoft/crypto package from the public Go module mirror as of December 16, 2025, indicating the package remained available months after publication.
The malicious package github.com/xinfeisoft/crypto, designed to impersonate golang.org/x/crypto, was listed on pkg.go.dev with a publication date of v0.15.0 on February 20, 2025.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked **222 GitHub repositories** across **190 accounts** to a malware distribution campaign dubbed **Operation Muck and Load**, which used fake Go packages and deceptive software projects to trick developers into importing malicious code. The repositories were dressed up with synthetic GitHub Actions activity, manufactured commit history, and lure themes including cryptocurrency tools, Telegram bots, game cheats, and offensive utilities. Investigators tied the activity to a shared actor email address, `ischhfd83@rambler[.]ru`, and identified a malicious module, `github[.]com/kaleidora/dnsub-scanning-tool`, as a first-stage Windows loader. Once executed, the package launched obfuscated PowerShell, used a dead-drop resolver on public platforms to locate current command-and-control infrastructure, and fetched staged payloads from Muck-themed servers. The infection chain delivered malware including **Vidar infostealer**, **AsyncRAT**, **Quasar RAT**, **Remcos-style RATs**, spyware, and **Monero cryptominers** tied to XMRig. Reporting said the operation abused developer trust rather than a flaw in Go itself, but warned that Linux build pipelines, CI/CD runners, developer workstations, and cached credentials remain exposed in mixed-platform environments if malicious modules are pulled into builds.
Jul 11, 2026
Researchers reported continued use of the **Rekoobe** Linux backdoor in intrusions tied to China-linked **APT31**, including attacks against Korean organizations and Linux servers. Rekoobe, derived from the open-source Tiny SHell project, has appeared in multiple variants across `x86`, `x64`, and `SPARC` systems and typically provides file upload, file download, and reverse shell access. In one analyzed case, the malware contacted `resolv.ctmailer[.]net:80`, disguised its process name as `/bin/bash`, and protected command-and-control traffic with **AES-128** encryption derived from an **HMAC-SHA1** routine and a hard-coded password. Separate analysis found Rekoobe operating alongside the **Syslogk** Linux kernel rootkit, forming a stealthy persistence and remote access toolkit. Syslogk, based on the open-source **Adore-Ng** rootkit, hides files, processes, and network activity, removes itself from kernel module listings, and can remotely start or stop Rekoobe using specially crafted TCP magic packets. Researchers also observed Rekoobe masquerading as a fake SMTP service and spawning a shell after receiving a specific backdoor command over TLS, reinforcing that the malware remains an active and adaptable threat to poorly maintained or unpatched Linux environments.
Aug 15, 2026
Researchers identified a malicious Go module, `github.com/kaleidora/dnsub-scanning-tool`, that posed as a DNS and subdomain scanning utility while delivering a Windows-focused malware chain. The package reportedly launched hidden PowerShell execution and used dead-drop resolver techniques to retrieve follow-on infrastructure, turning a seemingly legitimate developer tool into an initial access vector for staged payload delivery. The investigation expanded beyond the single package into a broader GitHub lure network spanning **222 repositories** across **190 accounts**, which researchers tracked as **Operation Muck and Load**. The activity was linked to Muck-themed infrastructure and multi-stage loading behavior, and reporting included indicators of compromise such as domains, URLs, file hashes, an email address, and Windows file paths tied to staging and payload execution.
Jul 14, 2026