New PamDOORa Backdoor Attacking Linux Systems to Steal SSH Credentials

Cybersecuritynews •Tushar Subhra Dutta • May 8, 2026

A new backdoor called PamDOORa has emerged as a serious and growing threat to Linux systems, targeting one of the most trusted components of the operating system to silently steal SSH credentials. The malware was advertised for sale on a Russian-speaking cybercrime forum called Rehub, with its complete source code initially listed at $1,600 before […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Pam Backdoor Exploits PAM Modules to Steal SSH Credentials from Linux Systems A new backdoor, named Pam, has been identified targeting Linux systems by exploiting Pluggable Authentication Modules (PAM) to capture SSH credentials. This technique allows attackers to maintain persistence on compromised systems. The backdoor leverages the modular architecture of Linux, which has been in use since 1991, making it particularly stealthy and difficult to detect. The attack primarily affects Linux servers and workstations that utilize PAM for authentication. As of now, there are no specific CVEs or patches reported for this backdoor, and its full impact on the Linux community remains to be assessed. Security professionals are advised to monitor their systems closely for any signs of compromise. The threat level is considered significant due to the potential for widespread exploitation. 5 sources 59

Extracted Entities

New PamDOORa Backdoor Attacking Linux Systems to Steal SSH Credentials

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)