Researchers at German infosec services company Nextron Threat have spotted malware that creates a highly-persistent Linux ...

A newly discovered Linux malware, which has evaded detection for over a year, allows attackers to gain persistent SSH access ...

A malicious PAM module, undetected by VirusTotal, embedded itself in the login process, granting covert access and resisting ...

"The implant is built as a malicious PAM (Pluggable Authentication Module), enabling attackers to silently bypass system ...

PAM, or pluggable authentication modules, are mechanisms that combine a series of lower tiered authentication schemes into a higher-level API.

The authentication mechanism was implemented as a JAAS login module and used CAPTCHAs to weakly authenticate users. To a certain extent, it also guaranteed that the remote user is human.