Plague PAM-Based Backdoor for Linux (Campaign)

Plague is a PAM-based Linux backdoor that impersonates legitimate shared libraries (for example, `libselinux.so.8`) to hook into the authentication stack and grant stealthy, persistent SSH access using hardcoded passwords. The implant employs layered obfuscation (XOR, custom KSA/PRGA-like routines, DRBG), anti-debug checks, and clears SSH-related environment variables and shell history to evade detection and leave minimal forensic traces; samples date back to mid-2024, indicating active development.