Malicious Go “crypto” Module Steals Passwords

Researchers at Socket discovered a malicious Go module impersonating the legitimate golang.org/x/crypto library that intercepts password prompts, captures secrets, and phones home to attacker-controlled infrastructure. The backdoor executes a multi-stage Linux attack chain delivering the Rekoobe backdoor, establishing SSH persistence, and weakening firewall defenses through iptables modifications on Ubuntu systems. AhnLab’s ASEC team describes Rekoobe as a Linux server backdoor built on the open-source Tiny SHell and known to be used by the China-based group APT31. Supply chain attacks in Go modules: because go get should really come with a trust-but-verify warning label.