PamDOORa Backdoor Targets Linux PAM Stack to Steal Passwords and Wipe Logs

A newly reported Linux backdoor called PamDOORa embeds into the PAM authentication stack to harvest credentials and maintain persistent SSH access via a ‘magic’ password and port; it includes anti-forensic log tampering and is being sold on a Russian cybercrime forum, creating a high-risk, stealthy post-exploitation threat that can bypass standard application-layer monitoring.