AISEC > Security News > Malware > Malicious Go Crypto Module Steals Passwords, Deploys Backdoor
February 27, 2026 #malware Source: The Hacker News 3 min read · 647 words

Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor

Шкідливий Go модуль для крипто-валют крадає паролі та розгортає бекдор Rekoobe

A Trojan Horse in Your Dependencies

A malicious Go module masquerading as a legitimate cryptocurrency library has been caught red-handed stealing passwords, establishing persistent SSH access, and deploying the Rekoobe Linux backdoor. Security researchers disclosed the attack, which represents an active supply chain threat targeting developers who might unknowingly pull the poisoned package into their projects.

This isn't theoretical anymore. It's happening right now.

The Breach

According to The Hacker News, the compromised module was designed to fool developers into thinking they were installing a genuine crypto library. The package targets-education-healthcare/" class="internal-link">targets a specific vulnerability in developer workflows: the assumption that dependencies are trustworthy. Developers search for a crypto library, find what looks like the right thing, install it—and suddenly their systems are compromised.

And here's what makes this particularly nasty: it's a supply chain attack in its purest form. The attacker doesn't need to compromise a major repository or crack famous developers' credentials. They just need developers to make one small mistake.

Who got hit? The disclosed reports don't name specific victims yet, but that's because the threat is ongoing. Any developer who installed this module between discovery and disclosure is potentially exposed.

Under the Hood

The malicious module performs a trifecta of bad things. First, it exfiltrates passwords—the kind of data that opens doors to everything else a developer might have access to. Second, it establishes persistent SSH access, meaning attackers get to hang around indefinitely. Third, and most insidious, it deploys Rekoobe, a Linux backdoor that gives attackers remote code execution.

Why SSH specifically?

SSH cyber security is foundational to how development teams operate. SSH vulnerability exploitation gives attackers the ability to remotely access systems without detection. An SSH cyber security breach of this magnitude doesn't just compromise one machine—it compromises the trust model of entire development pipelines. The module essentially opens an SSH backdoor that could persist long after the initial infection.

The technical sophistication here suggests this wasn't some script kiddie's weekend project. This was deliberate. Calculated. The kind of attack that reveals how fragile our supply chain really is.

The Fallout

Let's be clear about what's at stake. This is a textbook example of what cyber attacks look like when they succeed at scale. Unlike dramatic cyber security attacks examples you might read about—ransomware taking down hospitals, DDoS attacks crashing services—this one is surgical and stealthy. It's signs of cyber attack that most people would miss entirely.

An SSH DDoS attack is one thing. An SSH vulnerability that opens persistent backdoor access is something else entirely.

The consequences ripple outward. Any credentials the compromised machines can access become potential entry points. Any code repositories they can reach become contamination vectors. Any systems they can SSH into become extensions of the attack. This is why supply chain attacks are so dangerous—they're not just compromising individual developers. They're potentially compromising entire organizations through trusted dependencies.

The attack definition in cyber security literature would classify this as a multi-stage supply chain compromise with credential theft and persistence mechanisms. It's textbook sophisticated.

Protecting Yourself

Start with the obvious: audit your dependencies. If you've installed any unusual Go crypto modules recently, check your install history against known repositories. Cross-reference with what's actually documented in official package registries.

But here's what most people miss: dependency auditing isn't a one-time thing. You need to be continuously monitoring what gets installed into your environments. Tools like Dependabot and Snyk can help, but they're not magic bullets.

Second, use SSH key management that doesn't suck. Rotate credentials regularly. Monitor SSH access logs aggressively. If you see unexpected SSH connections from developer machines, treat it seriously. An SSH vulnerability that gives backdoor access means attackers can do anything from anywhere.

Third, implement code review processes that actually catch malicious packages. That means understanding what your dependencies do at a basic level, not just trusting that the name looks right.

And finally, consider using supply chain security tools designed specifically for this threat. The cost of infection is always higher than the cost of prevention.

Read original article →

// FAQ

How do I know if I installed the malicious Go crypto module?

Check your Go module dependencies in go.mod files and your package manager history. Compare against official cryptocurrency library names in the Go package registry—the malicious module impersonated a legitimate library with a similar or deceptive name.

What is the Rekoobe backdoor and what can it do?

Rekoobe is a Linux backdoor that grants attackers remote code execution and persistent access to compromised systems. Once installed, it allows attackers to execute arbitrary commands, steal data, and maintain long-term presence on infected machines.

Can SSH DDoS attacks happen if my system has this malicious module installed?

While the module itself establishes SSH backdoor access rather than launching DDoS attacks, compromised systems can be weaponized for DDoS operations. The primary threat is SSH vulnerability exploitation and persistent remote access by attackers.

// RELATED

#malware Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience 2026-02-27 #malware UAT-10027 Targets U.S. Education and Healthcare with Dohdoor Backdoor 2026-02-26 #malware MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP 2026-02-23

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →