PamDOORa: A Linux PAM Backdoor Built to Steal SSH Credentials
A new post-exploitation implant abuses the Linux authentication stack (PAM) to harvest plaintext SSH credentials from every user who logs in, and hands the operator a covert, persistent backdoor.
- Linux Backdoor
Bottom line. PamDOORa only lands after an attacker already has root, so treat any unexpected PAM module or change to /etc/pam.d/ (especially sshd) as evidence of a breach, ship your auth logs off-host so they can’t be wiped, and hunt for it now rather than waiting for a signature.
Background
Pluggable Authentication Modules (PAM) is the framework Linux uses to decide who gets to log in. Because PAM modules run with root privileges and PAM passes credentials through in plaintext rather than storing them, a single malicious module planted in the authentication path can silently capture every password and grant hidden access, a powerful and stealthy place for an attacker to sit.
PamDOORa, detailed by Flare.io researcher Assaf Morag, is a PAM-based post-exploitation backdoor for x86_64 Linux advertised on the Rehub Russian cybercrime forum by a threat actor using the handle “darkworm.” It is the second PAM-stack backdoor after Plague to surface in the past year, and Morag characterises it as operator-grade tooling, a cohesive, modular implant rather than the crude proof-of-concept scripts usually found in public repositories.
What we observed
Based on the public technical reporting, PamDOORa’s tradecraft breaks down as follows:
- Post-exploitation by design: the implant requires root to install, so it is a persistence-and-credential-harvesting layer dropped after an initial compromise, not an initial-access vector.
- It plants a malicious PAM module (reported as pam_linux.so) and abuses pam_exec to run attacker scripts during authentication, hooking into the login flow via /etc/pam.d/sshd.
- Once in the PAM stack it captures the plaintext passwords, and optional SSH key passphrases, of every legitimate user who authenticates through the compromised host.
- It grants the operator covert, persistent SSH access using a “magic password” combined with a specific TCP port, so normal accounts and logs look untouched.
- Harvested credentials are stored locally (reported under /tmp, XOR-encoded) for later collection.
- It ships with anti-forensic and evasion features: tampering with authentication logs to erase traces, anti-debugging, network-aware triggers, and a builder pipeline for generating implants.
- Commercially available: “darkworm” first listed it at $1,600 on 17 March 2026 and cut the price to $900 by 9 April 2026. There is no evidence yet of use in real-world attacks.
PamDOORa attack chain
Persistence via a magic password + TCP port; authentication logs are tampered to hide it.
Attribution
PamDOORa is a for-sale toolkit attributed only to the forum persona “darkworm” on Rehub; there is no link to a known, named threat group. Flare.io assesses it as distinct from the earlier Plague PAM backdoor, though a definitive binary-level comparison has not been published, so full overlap cannot be entirely ruled out.
Confidence: 75%.
PAM never stores your password. It hands it over in plaintext. PamDOORa simply waits at the door and copies every one.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Persistence / Credential Access | Modify Authentication Process: Pluggable Authentication Modules | T1556.003 | Plants a malicious PAM module and alters /etc/pam.d/sshd to capture credentials and persist. |
| Execution | Event Triggered Execution | T1546 | Abuses pam_exec to run attacker scripts during the authentication event. |
| Command and Control | Traffic Signaling: Port Knocking | T1205.001 | Covert access is unlocked by a magic password plus a specific TCP port combination. |
| Defense Evasion | Indicator Removal: Clear Linux or Mac System Logs | T1070.002 | Tampers with authentication logs to erase traces of malicious logins. |
| Defense Evasion | Masquerading: Match Legitimate Name or Location | T1036.005 | The malicious module is named to blend in with legitimate PAM modules (e.g. pam_linux.so). |
| Defense Evasion | Debugger Evasion | T1622 | Includes anti-debugging to frustrate analysis. |
ATT&CK techniques by tactic
Distribution of the six techniques mapped below.
Detection
Copy-ready hunting query:
# Hunt for unexpected or recently-changed PAM modules and sshd PAM config (Linux)
# 1) PAM modules newer than a stable baseline file:
find /lib/security /lib64/security /usr/lib/security /usr/lib64/security /lib/x86_64-linux-gnu/security \
-name '*.so' -newer /etc/hostname -printf '%TY-%Tm-%Td %p\n' 2>/dev/null
# 2) pam_exec entries or unfamiliar modules in the PAM config:
grep -R -line-number -E 'pam_exec|pam_linux' /etc/pam.d/ 2>/dev/null
stat -c '%y %n' /etc/pam.d/sshd
# 3) Verify PAM packages against the package manager's known-good state:
dpkg -V libpam-modules 2>/dev/null; rpm -Va 2>/dev/null | grep -i pamRecommendations
- Treat any unexpected PAM module (.so) or modification to /etc/pam.d/, especially sshd, as a compromise until proven otherwise; verify module integrity against your package manager (dpkg -V / rpm -Va) and file-integrity monitoring.
- Because PamDOORa only deploys after root access, prioritise preventing and detecting the initial intrusion: privileged-change alerting, least-privilege, and FIM on the PAM module directories and /etc/pam.d/.
- Defeat the anti-forensics: forward authentication logs to a remote, append-only log store in real time so local tampering cannot hide the intrusion, and alert on log gaps.
- Hunt for the covert channel: baseline listening TCP ports on SSH-facing hosts and alert on new or unexpected ports, and review for anomalous successful logins that bypass normal credentials.
