New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials
New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials
https://thehackernews.com/2026/05/new-linux-pamdoora-backdoor-uses-pam.html
Publish Date: 2026-05-08 04:41:00
Source Domain: thehackernews.com
Cybersecurity researchers have disclosed details of a new Linux backdoor named PamDOORa that’s being advertised on the Rehub Russian cybercrime forum for $1,600 by a threat actor called “darkworm.”
The backdoor is designed as a Pluggable Authentication Module (PAM)-based post-exploitation toolkit that enables persistent SSH access by means of a magic password and specific TCP port combination. It’s also capable of harvesting credentials from all legitimate users who authenticate through the compromised system.
“The tool, called PamDOORa, is a new PAM-based backdoor, designed to serve as a post-exploitation backdoor, enabling authentication to servers via OpenSSH,” Flare.io researcher Assaf Morag said in a technical report. “Allegedly this would remain persistent on Linux systems (x86_64).”
PamDOORa is the second Linux backdoor targeting the PAM stack after Plague. PAM is a security framework in Unix/Linux operating systems that grants system administrators the ability to incorporate multiple authentication mechanisms or update them (e.g., switching from passwords to biometrics) into an existing system through the use of pluggable modules without the need for rewriting existing applications.
Because PAM modules typically run with root privileges, a compromised, misconfigured, or malicious module can introduce significant security risks and open the door to credential harvesting and unauthorized access.
“Despite its strengths, the Pluggable Authentication Module’s (PAM) modularity introduces risks, as malicious modifications to PAM modules can create backdoors or steal user credentials, especially since PAM does not store passwords but transmits values in plaintext,” Group-IB noted in September 2024.
“The pam_exec module, which allows the execution of external commands, can be exploited by attackers to gain unauthorized access or establish persistent control by injecting malicious scripts into PAM…
