New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials

PamDOORa is a new PAM-based Linux backdoor sold on Russian cybercrime forums that enables persistent SSH access and credential harvesting.

• •Uses Pluggable Authentication Module framework to establish persistent post-exploitation access via magic password and TCP port combination
• •Harvests credentials from all legitimate users authenticating through the compromised system
• •Includes anti-forensic capabilities to tamper with authentication logs and erase traces of malicious activity
• •Exploits pam_exec module to execute malicious scripts injected into PAM configuration files
• •Demonstrates operator-grade integration of PAM hooks, credential capture, and log tampering techniques

This summary was automatically generated by AI based on the original article and may not be fully accurate.