Linux XMRig Botnet Abuses PAM for Fileless Monero Mining and Persistent Access

Gbhackers •Mayura Kathir • July 30, 2026

A covert Monero (XMR) cryptomining campaign uncovered in May 2026 is abusing Linux Pluggable Authentication Modules (PAM) to evade detection, maintain fileless execution, and persist across multiple user accounts on compromised hosts. The operation, tracked as part of the V25 (Generation 26) campaign family, demonstrates a mature blend of supply chain abuse, PAM weaponization, and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Covert Linux XMRig Campaign Exploits PAM for Cryptomining In July 2026, a sophisticated cryptomining campaign utilizing XMRig was discovered, targeting Linux systems. The attackers exploited trusted access through third-party relationships, allowing them to infiltrate networks undetected. They weaponized the Linux Pluggable Authentication Modules (PAM) to create a forensic smokescreen, enabling lateral movement while suppressing logging to avoid detection. The malware, a modified version of XMRig, was designed to run silently and avoid resource contention. This campaign poses a significant risk to organizations using Linux systems, as it can persist undetected through multiple user accounts. The full scope of affected systems is still being assessed, and organizations are urged to enhance their monitoring capabilities. 3 sources 70

Extracted Entities

Linux XMRig Botnet Abuses PAM for Fileless Monero Mining and Persistent Access

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)