Back Cybersecuritynews

Malicious Go Crypto Module Steals Passwords and Deploy Rekoobe Backdoor in Developer Environments

Cybersecuritynews •Tushar Subhra Dutta • February 27, 2026

Malicious Go Crypto Module Steals Passwords and Deploys Rekoobe Backdoor in Developer Environments A newly discovered supply chain attack is putting Go developers at serious risk. A threat actor published a malicious Go module that closely mimics one of the most trusted cryptographic libraries in the ecosystem — golang.org/x/crypto — and used it to steal […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Go Module Targets Developers with Credential Theft and Rekoobe Backdoor A supply chain attack has been identified involving a malicious Go module, github.com/xinfeisoft/crypto, which impersonates the legitimate golang.org/x/crypto library. This module is designed to exfiltrate sensitive credentials and deploy the Rekoobe Linux backdoor, affecting developers using Go in their environments. The attack utilizes namespace confusion and multi-stage payload delivery techniques. 4 sources 31

Extracted Entities

Malicious Go Crypto Module Steals Passwords and Deploy Rekoobe Backdoor in Developer Environments

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)