🚨 Malicious Go Crypto Module Steals Passwords and Installs Linux Backdoor
A malicious Go module disguised as a legitimate cryptography library has been discovered stealing passwords and deploying a Linux backdoor inside developer environments.
The backdoored package mimics Go’s trusted golang.org/x/crypto library and targets developer machines and CI/CD pipelines where credential prompts are common.
Once installed, the module quietly captures passwords and installs a Rekoobe Linux backdoor, giving attackers persistent remote access to compromised systems.
This campaign highlights the growing risk of software supply chain attacks within open-source ecosystems.
🧩 The Fake Crypto Module
Researchers identified the malicious package as:
The module was designed to look nearly identical to the legitimate Go cryptography library.
It included familiar subdirectories developers expect to see:
argon2
bcrypt
ssh
This structure allowed the malicious module to blend seamlessly into dependency trees and appear legitimate during code reviews.
To further mask its behavior, the attackers added a dependency on the legitimate github.com/bitfield/script package, which allowed the malware to perform HTTP requests and execute shell commands while keeping the surrounding codebase looking normal.
🔐 Password Theft Through a Backdoored Function
The key compromise point lies inside the file:
ssh/terminal/terminal.go
This file contains a commonly used helper function called ReadPassword.
Many command-line tools rely on this function to collect sensitive input such as:
SSH passphrases
database credentials
API tokens
administrative passwords
The malicious module modified this function to secretly capture user input.
When a user enters a password, the backdoor:
1️⃣ Reads the password normally using term.ReadPassword
2️⃣ Saves the plaintext password to a hidden file:
/usr/share/nano/.lock
3️⃣ Sends the captured password to an attacker-controlled server
Because the function still behaves normally from the user’s perspective, the compromise occurs without any visible signs.
🕵️ Stealthy Command Execution
After stealing credentials, the malware retrieves additional instructions from an attacker-controlled staging page hosted on GitHub Raw.
This staging mechanism allows the attackers to change infrastructure dynamically without updating the malicious package.
Once the staging URL is retrieved, the module:
exfiltrates stolen passwords via HTTP POST
downloads a remote shell script
executes the script using /bin/sh
This shell script acts as a Linux infection stager.
🧨 System Compromise and Backdoor Deployment
The downloaded script performs several actions to prepare the system for persistent access.
These include:
🔑 Adding an attacker-controlled SSH key to:
/home/ubuntu/.ssh/authorized_keys
🔥 Changing firewall rules to allow unrestricted network traffic
📥 Downloading additional malware payloads disguised as media files:
sss.mp5
555.mp5
These files are retrieved from attacker infrastructure hosted at:
After execution, the files are deleted to reduce forensic evidence.
🐍 The Rekoobe Backdoor
Analysis revealed that one of the downloaded binaries installs Rekoobe, a Linux backdoor derived from the Tiny SHell malware family.
Rekoobe enables attackers to:
maintain persistent access
execute remote commands
exfiltrate data
control compromised systems
Network traffic analysis shows the backdoor communicating with a command-and-control server at:
154.84.63.184:443
While the connection uses port 443, it does not follow normal TLS handshake patterns, making it a covert command channel disguised as HTTPS traffic.
🧠 Supply Chain Attack on Developers
This campaign demonstrates how attackers can compromise environments by targeting trusted software libraries.
Rather than attacking production systems directly, threat actors weaponize developer dependencies and wait for the code to be executed inside build environments.
Because the malicious behavior triggers during interactive password entry, automated tests and static scans may fail to detect it.
This makes developer workstations and CI pipelines especially vulnerable.
🛡 Defensive Measures
Organizations should treat open-source dependencies as part of their security perimeter.
Recommended protections include:
1️⃣ Audit Go Modules
Review go.mod and go.sum files for unexpected dependencies.
2️⃣ Monitor Suspicious File Activity
Alert on writes to unusual locations such as:
/usr/share/nano/.lock
3️⃣ Detect Suspicious Network Activity
Look for:
GitHub Raw requests followed by dynamic POST requests
unusual outbound connections over port 443
downloads of disguised payload files
4️⃣ Monitor System Changes
Security teams should watch for:
unauthorized changes to authorized_keys
firewall rules being modified to ACCEPT
unexpected shell execution chains
🎯 Security Takeaway
Software supply chain attacks are rapidly becoming one of the most effective ways to compromise modern infrastructure.
Instead of breaking through firewalls or exploiting servers directly, attackers simply poison the tools developers rely on every day.
In this case, a single modified function inside a trusted library was enough to:
steal credentials
deploy a backdoor
establish persistent system control
For organizations relying on open-source ecosystems, dependency security must now be treated as a core cybersecurity priority.
Because sometimes the most dangerous malware isn’t downloaded from the internet…
It’s imported through a dependency.
