Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor

Researchers disclosed a supply-chain attack where a malicious Go module impersonating golang.org/x/crypto hooks ReadPassword() to steal terminal-entered passwords, then stages a shell script that installs an SSH key, loosens firewall rules, and downloads additional payloads — including a helper contacting 154.84.63.184:443 and the Rekoobe Linux backdoor (historically associated with APT31); the package was later blocked by the Go security team.