PamDOORa is a reminder that Linux server security cannot stop at patching alone. Since this backdoor abuses PAM, the authentication layer itself becomes the point of persistence, credential theft, and log tampering. That makes it especially dangerous for SSH-exposed systems, where one compromised root-level module can silently capture valid credentials and maintain unauthorized access.

Organizations should regularly verify PAM configuration files, monitor unexpected changes in authentication modules, restrict SSH exposure, review privileged access, and correlate login activity with network-level logs rather than trusting local authentication logs alone. Once attackers can tamper with local logs, relying only on the compromised system’s own records is, frankly, asking the burglar to maintain the visitor register. 

Current reporting says PamDOORa is being advertised as a post-exploitation toolkit and there is no confirmed evidence yet of real-world deployment, but the technique is serious because it targets a trusted part of Linux authentication itself.

Cybersecurity researchers have disclosed details of a new Linux backdoor named PamDOORa that's being advertised on the Rehub Russian cybercrime forum for $1,600 by a threat actor called "darkworm." The backdoor is designed as a Pluggable Authentication Module (PAM)-based post-exploitation toolkit that enables persistent SSH access by means of a magic password and specific TCP port combination.

Source: New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials via The Hacker News — published 08 May 2026.