New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials

Researchers disclosed a new Linux backdoor named PamDOORa, advertised on the Rehub Russian cybercrime forum by a threat actor called “darkworm.” The tool is a PAM-based post-exploitation toolkit that enables persistent SSH access through a magic password and specific TCP port combination and can harvest credentials from users authenticating through the compromised system.