Compromised Go Crypto Package Delivers Rekoobe Malware To Dev Systems

Researchers from Socket have uncovered a malicious Go module that impersonates the widely trusted golang.org/x/crypto package.

The rogue module, published on GitHub [.]com/xinfeisoft/crypto, copies the structure of the legitimate cryptography library but secretly inserts a backdoor into the ssh/terminal/terminal.go file.

The real golang.org/x/crypto repository provides essential cryptographic functions, including bcrypt, argon2, chacha20, and SSH utilities.

Because it is a foundational dependency across thousands of Go projects, it represents a high-trust target for supply chain abuse.

By closely mirroring the original repository, the malicious package blends naturally into dependency graphs and may evade quick visual inspection.

The backdoor specifically modifies the ReadPassword function. This function is commonly used by command-line applications to securely capture user credentials, such as SSH passphrases, database passwords, and API keys.

Instead of simply returning the entered password, the altered function captures the secret, writes it to a local file at /usr/share/nano/.lock, and sends it to attacker-controlled infrastructure.

To hide its command-and-control (C2) flow, the malware retrieves a staging URL from a GitHub Raw file in an attacker’s separate repository.

That pointer then redirects the infected system to a malicious endpoint, where a shell script is downloaded and executed via /bin/sh. This design allows attackers to rotate infrastructure without republishing the Go module.

As of publication, the malicious module had appeared on pkg.go.dev with a February 2025 release date.

Following responsible disclosure, the Go security team blocked the module from the public proxy, returning a 403 security error. However, systems that previously downloaded or vendored the package may remain exposed.

Linux Stager Deploys Rekoobe Backdoor

The downloaded shell script acts as a Linux stager. It appends an attacker-controlled SSH key to /home/ubuntu/.ssh/authorized_keys, granting persistent remote access. It also weakens firewall protections by setting iptables default policies to ACCEPT.

Next, the script downloads two disguised payloads sss.mp5 and 555.mp5 from img[.]spoolsv[.]cc. Although labeled with a media-style extension, both files are executables.

Analysis confirmed that 555.mp5 installs the Rekoobe backdoor, a known espionage-oriented malware family. Rekoobe has historically been linked to advanced threat activity, including operations associated with APT31.

According to Socket, network traffic from infected systems showed outbound communication to 154[.]84[.]63[.]184 over TCP port 443.

However, the traffic did not resemble standard HTTPS handshakes. This suggests custom-encrypted communications designed to appear legitimate at the port level.

Security experts warn that this campaign highlights the ongoing risk of open-source supply chain attacks.

Developers are urged to carefully review changes to go.mod and go.sum, monitor additions to dependencies, and implement automated scanning tools to detect suspicious modules before deployment.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.