New PamDOORa Backdoor Attacking Linux Systems to Steal SSH Credentials

PamDOORa is a newly reported Linux backdoor that hijacks the PAM authentication stack to silently capture SSH credentials, grant stealthy persistent access via a magic password and port, and perform anti-forensic cleanup of authentication logs; the malware (advertised on a cybercrime forum) includes IoCs such as a malicious pam_linux.so module, tn.sh script, /tmp credential files, use of port 1234, and modifications to /etc/pam.d/sshd, and researchers provide mitigation and monitoring recommendations.