Loading story…
Group-IB reported that attackers can abuse Linux Pluggable Authentication Modules (PAM) by modifying SSH authentication settings to invoke the pam_exec module, turning a legitimate feature into a stealthy credential-theft and persistence mechanism. In the demonstrated technique, a malicious script is triggered during SSH login attempts—including failed authentications—to collect usernames and environment data and send them to a remote host, while standard logs may show only unsuccessful SSH access and not the hidden execution path.
The technique affects a core authentication framework used by services such as sshd, login, su, and passwd, making PAM configuration integrity a high-value defensive priority on Linux systems. Group-IB said the same approach could support backdoors, covert command execution, and long-term persistence, and recommended hardening measures including timely patching, enforcing SELinux or AppArmor, monitoring with Auditd and Wazuh, and using tools such as PSAD, AIDE, and rkhunter to detect unauthorized changes and suspicious activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Group-IB published a technical analysis showing how Linux PAM configuration can be modified to invoke pam_exec during SSH authentication, enabling malicious scripts to run even on failed login attempts. The write-up describes exfiltration of user and environment data via netcat while standard logs may only show failed SSH authentication, and includes hardening recommendations.
Palo Alto Networks Unit 42 published research on malware using Linux PAM authentication modules for malicious activity. The report documented PAM abuse as a persistence and credential-theft mechanism on Linux systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have disclosed **PamDOORa**, a Linux backdoor that abuses the **Pluggable Authentication Module (PAM)** framework to steal SSH credentials and maintain covert persistence on already-compromised `x86_64` systems. Advertised on the Russian-speaking cybercrime forum **Rehub** by an actor using the alias **"darkworm,"** the malware is positioned as a post-exploitation toolkit and was reportedly offered for sale with its source code. It intercepts credentials from legitimate users during authentication by abusing `pam_exec` and inserting a malicious PAM component into the login stack. PamDOORa also enables hidden SSH access through a **magic password** tied to a specific TCP port, while anti-forensic functions tamper with records such as `lastlog`, `btmp`, `utmp`, and `wtmp` to conceal activity and complicate investigations. Researchers said the malware appears to require prior root-level compromise for deployment, and there is **no confirmed evidence yet of active in-the-wild attacks**, but they described it as a more mature, operator-grade evolution of earlier PAM backdoor concepts because of its modular design, anti-debugging features, network-aware triggers, and builder pipeline.
Jun 29, 2026
Sygnia reported that the China-linked threat group **Velvet Ant** maintained covert access to an organization's network for nearly a decade by modifying trusted Linux authentication components in an intrusion campaign dubbed **Operation Highland**. Instead of relying on conventional malware, the attackers backdoored **PAM** and **OpenSSH** to bypass authentication with a secret password, steal legitimate credentials, and log commands while blending in with normal administrative activity. Researchers identified **nine distinct versions** of the tampered software, indicating the operation evolved over years and that the earliest observed activity dates back to **2016**. The intrusion reportedly reached an air-gapped or otherwise isolated environment by staging through internet-facing systems and using a web server as a bridge into the segmented network. Sygnia said the case shows why patching and password resets alone are insufficient when trusted login binaries have been altered, and urged defenders to verify the integrity of PAM and OpenSSH files against known-good copies, remove backdoors before resetting credentials, and monitor or patch related edge infrastructure. The tradecraft aligns with Velvet Ant's broader pattern of hiding in trusted systems, including prior activity involving **F5 BIG-IP** devices and exploitation of **`CVE-2024-20399`** on **Cisco NX-OS** switches.
Jul 12, 2026
Researchers and vendors disclosed **CVE-2026-46333**, a Linux kernel flaw in `__ptrace_may_access()` that lets an unprivileged local user exploit a process-exit race to bypass authorization checks and steal file descriptors from privileged processes. The bug has existed since Linux `v4.10-rc1`, and exploitation became more practical with `pidfd_getfd()` introduced in `v5.6-rc1`. Qualys and public proof-of-concept authors showed the issue can expose `/etc/shadow`, leak OpenSSH host private keys through `ssh-keysign`, and in some cases execute commands as root via targets including `chage`, `pkexec`, and `accounts-daemon` on default Debian, Ubuntu, Fedora, AlmaLinux, and other distributions. Linus Torvalds merged the upstream fix in commit `31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a`, and stable kernel updates were released across multiple branches as distributions began shipping patched packages. Public exploit code appeared almost immediately after the fix became visible, increasing the urgency for defenders to patch and reboot affected systems, rotate potentially exposed **SSH host keys** and other credentials, and review systems for local privilege-escalation activity. Where immediate patching is not possible, several vendors and Qualys said raising `kernel.yama.ptrace_scope` to `2` or `3` can block known exploit paths, although maintainers cautioned that such settings are only a temporary workaround and may disrupt debugging tools.
Jul 23, 2026