If an attacker secures root access on your Linux server, changing every user password will not save you. Pluggable Authentication Modules (PAM) sit directly in the authentication path, processing plaintext credentials in transit before hashes are ever computed or evaluated. When malware hooks this layer, the operating system's primary gatekeeper becomes the adversary's most reliable collection agent.
Security researchers have detailed PamDOORa, a specialized post-exploitation toolkit targeting the Linux PAM stack. Initially surfaced on the Russian cybercrime forum "Rehub" by an actor operating under the handle "darkworm," the implant represents a shift from crude proof-of-concept scripts to a modular, operator-grade persistence engine.
Anatomy of an In-Path Authentication Hook
PamDOORa targets Linux (x86_64) systems and represents the second known Linux backdoor purposefully built around the PAM framework, following DopePAM.
Understanding why this architecture is devastating requires looking at how PAM operates:
[ Inbound SSH / Auth Request ]
│
▼
┌──────────────────┐
│ OpenSSH Daemon │
└────────┬─────────┘
│ (Hands off plaintext auth token)
▼
┌──────────────────┐
│ PAM Stack │ ◄─── [ PamDOORa Hook Injected Here ]
└────────┬─────────┘ ├─ Intercepts Plaintext Password
│ ├─ Evaluates "Magic Password" Bypass
▼ └─ Scrub Forensic Logs
┌──────────────────┐
│ System Auth / DB │
└──────────────────┘
PAM allows administrators to configure pluggable authentication schemes without rewriting core system daemons. However, because PAM modules execute with full root privileges and must handle unhashed authentication secrets directly in transit, an in-path compromise gives an attacker absolute leverage.
PamDOORa abuses this design to execute three primary functions:
- Passive Credential Harvesting: Because PAM handles authentication material in memory prior to hashing, the implant captures credentials from every legitimate user authenticating against the compromised host.
- Persistent SSH Ingress: The module implements a "magic" password mechanism tied to a specific TCP port trigger, granting unauthorized administrative access regardless of whether legitimate user credentials rotate.
- Anti-Forensic Log Tampering: The implant systematically alters authentication logs, stripping out traces of unauthorized access and raising the barrier for incident responders.
Configuration Abuse and the pam_exec Vector
Beyond custom compiled modules, standard PAM functionality provides native primitives that attackers frequently exploit for identical outcomes. Security vendor Group-IB highlighted that the standard pam_exec module, designed to run external binaries during authentication phases, remains a primary attack vector.
When an attacker establishes initial root access, they can modify SSH authentication rules within the PAM configuration files to invoke scripts via pam_exec. This pattern exposes a critical structural risk:
- Privileged Execution Context: External scripts executed by
pam_execrun with elevated privileges. - Shell Spawning: Attackers can abuse these hooks to grant a privileged shell directly on the host during standard connection attempts.
- Zero Credential Footprint: Malicious scripts can intercept the plaintext variables passed down the PAM pipeline without interacting with traditional disk-based credential stores.
PamDOORa packages these techniques into a cohesive framework. Flare.io researcher Assaf Morag notes that while techniques like PAM hooks, credential theft, and log sanitization are well-documented individually, PamDOORa integrates them into a modular implant equipped with a pipeline builder, anti-debugging capabilities, and network-based triggers.
Underground Economics: Pricing the Implant
PamDOORa's market trajectory on illicit forums reflects shifting dynamics in the post-exploitation tooling trade.
| Date | Pricing (USD) | Market Movement |
|---|---|---|
| March 17, 2026 | $1,600 | Initial release by "darkworm" on Rehub |
| April 9, 2026 | $900 | ~50% price reduction |
A price drop of nearly 50% within weeks of release points to one of two market dynamics: either initial demand was weaker than anticipated, or the seller pivoted toward driving higher transaction volume among lower-tier operators.
Engineering Takeaways
There is currently no evidence of PamDOORa deployed in active, in-the-wild campaigns. The toolkit remains fundamentally a post-exploitation system: an attacker must first obtain root privileges to install and configure the malicious PAM module.
However, its emergence underscores an essential reality of infrastructure engineering. If integrity verification stops at user account audits, in-memory credential harvesting within the PAM subsystem will remain completely invisible. Securing Linux infrastructure requires auditing PAM configuration files, validating module binaries against known checksums, and treating the core authentication pipeline as an active attack surface.