A novel persistence technique targeting Linux environments, leverages the Linux Pluggable Authentication Module (PAM) architecture to grant threat actors persistent, privileged shell access.
Notably, this evasion tactic is highly stealthy and has not yet been classified in the MITRE ATT&CK framework.
The PamDOORa analysis was first published by Assaf Morag and the research team at Flare on May 7, 2026.
PamDOORa Targets Linux Systems
Linux operating systems rely on PAM as a modular framework for managing user authentication across applications such as SSH, FTP, and standard logins.
Because PAM separates authentication from applications, it provides administrators with extensive flexibility.
However, this modularity introduces significant security risks if configuration files are manipulated. The PamDOORa technique specifically exploits pam_exec, a standard module that executes external commands during authentication.
In a normal administrative setup, pam_exec might be used to trigger an email notification when a user changes their password.
Threat actors are now weaponizing this feature by injecting malicious lines into critical configuration files, such as the OpenSSH daemon configuration.
By adding a seemingly benign “optional” control flag to the PAM configuration, attackers ensure their malicious script executes without disrupting the normal authentication chain.
When an external host attempts an SSH connection, the compromised PAM configuration automatically triggers a hidden script.
This script aggressively harvests sensitive environment variables, including PAM_RHOST, PAM_SERVICE, and PAM_USER. The collected data is then piped via network utilities such as netcat directly to an attacker-controlled remote server.
The most alarming aspect of the PamDOORa backdoor is its ability to operate completely undetected by traditional security monitoring.
The threat actors deliberately configure the malicious script to execute specifically when an SSH authentication attempt fails. As a result, standard system logs will only record a routine failed login, leaving absolutely no trace of the underlying data exfiltration.
According to Group IB research, this clever abuse of native system features creates severe blind spots for corporate security teams.
Since the payload does not generate suspicious anomalies in the authentication logs, forensic investigators face immense challenges in identifying the breach.
Furthermore, the data can be intercepted and transmitted in plaintext, bypassing encryption controls because PAM handles variables before the host application securely processes them.
To defend against this stealthy threat, system administrators must implement strict file integrity monitoring on all PAM directory files.
Regular security assessments and hardening of Linux-based servers are critical to detecting and remediating unauthorized modifications to authentication modules immediately.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 Team have uncovered a novel persistence){kind=link}