Rescana Malicious Go Module Targets Developers with Credential Theft and Rekoobe Backdoor
Article Content
Browse articles 
A supply chain attack has been identified involving a malicious Go module, github.com/xinfeisoft/crypto, which impersonates the legitimate golang.org/x/crypto library. This module is designed to exfiltrate sensitive credentials and deploy the Rekoobe Linux backdoor, affecting developers using Go in their environments. The attack utilizes namespace confusion and multi-stage payload delivery techniques.
Ask AI about this cluster
Answers cite the sources they use
Updated 213d ago How this analysis works
Timeline
2026-02-27
Malicious Go module discovered mimicking trusted library
2026-03-01
Detailed report published on the attack and its techniques
More articles in this cluster (4)
Following this threat?
Track Rekoobe in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
New Linux Malware Mimics Asian Email Security Appliances Researchers have uncovered sophisticated Linux malware that closely imitates Korean and Taiwanese network edge appliances, making detection challenging. The malware includes backdoors such as BPFdoor and Rekoobe, which disguise themselves as legitimate processes, specifically targeting the popular SpamSniper anti-spam… 
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…