Linux Cryptomining Campaign Weaponizes PAM to Hide XMRig Botnet Activity

Cybersecuritynews •Tushar Subhra Dutta • July 30, 2026

A new Linux cryptomining campaign has surfaced using a rare trick to stay hidden inside compromised networks. Instead of behaving like typical malware, the operators turned a trusted Linux security feature into a tool for covering their tracks. This let them mine Monero cryptocurrency while dodging alerts that usually expose intruders. The attack began in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Covert Linux XMRig Campaign Exploits PAM for Cryptomining In July 2026, a sophisticated cryptomining campaign utilizing XMRig was discovered, targeting Linux systems. The attackers exploited trusted access through third-party relationships, allowing them to infiltrate networks undetected. They weaponized the Linux Pluggable Authentication Modules (PAM) to create a forensic smokescreen, enabling lateral movement while suppressing logging to avoid detection. The malware, a modified version of XMRig, was designed to run silently and avoid resource contention. This campaign poses a significant risk to organizations using Linux systems, as it can persist undetected through multiple user accounts. The full scope of affected systems is still being assessed, and organizations are urged to enhance their monitoring capabilities. 3 sources 70

Extracted Entities

Linux Cryptomining Campaign Weaponizes PAM to Hide XMRig Botnet Activity

The full story

Extracted Entities

Attack Types (1)

Malware (2)

Platforms (1)