The Cryptography Trojan: Malicious Go Module Impersonates Foundational Library to Steal Passwords and Deploy Root Backdoors

Socket’s Threat Research Team uncovered a malicious Go module masquerading as golang.org/x/crypto that modifies ReadPassword to capture user passwords, exfiltrate them to attacker-controlled infrastructure, and fetch a shell script which implants persistence (adds an SSH key, alters iptables) and downloads disguised payloads; one payload is the Rekoobe Linux backdoor associated with espionage campaigns.