Go Crypto Copycat: The Sneaky Module That Opens Backdoors on Linux Systems

It started with a typo, but ended with a breach. When developers reached for a popular cryptography library in the Go programming language, many inadvertently invited a digital burglar into their systems. Lurking behind a familiar name, this imposter module silently stole passwords and flung open the doors for deeper compromise. The operation, a masterclass in supply chain deception, underscores just how easily trust can be weaponized in the open source world.

The heart of the scheme was a Go module named github[.]com/xinfeisoft/crypto, a near-perfect doppelgänger of the well-known golang.org/x/crypto repository. This subtle switch-a classic case of "namespace confusion"-tricked automated systems and unwary developers into importing the rogue package. The attackers exploited the fact that while the legitimate project treats GitHub as a mirror, most developers and dependency tools see all code on GitHub as equally trustworthy.

Hidden inside the module’s ssh/terminal/terminal.go file, malicious code intercepted every password entered via the ReadPassword() function. Each time a user typed a secret into their terminal, the module quietly whisked it away to a remote server. But the attack didn’t stop at password theft. In response, the attacker’s server would send back a script, which the infected system would dutifully execute.

This script acted as a “stager” for further compromise. First, it granted the attacker persistent SSH access by adding their key to the system’s authorized_keys file. Next, it weakened firewall protections and pulled down additional payloads, disguised as innocuous files. Among these was Rekoobe, a Linux backdoor with a long and notorious history. Once installed, Rekoobe connected to attacker-controlled servers, ready to download new tools, steal files, or provide a remote shell for hands-on control.

Rekoobe is no newcomer; it’s been linked to Chinese cyber-espionage groups and has evolved over years to evade detection. Its deployment here, via a seemingly harmless code library, highlights the growing sophistication of supply chain attacks. Experts warn that as long as open source ecosystems rely on trust and convenience, attackers will keep exploiting blind spots-especially around software that handles credentials and authentication.

The malicious module has since been blocked, but the episode sounds a clear alarm: in the world of open source, even a single misplaced character can open the door to disaster.

WIKICROOK

• Supply Chain Attack: A supply chain attack is a cyberattack that compromises trusted software or hardware providers, spreading malware or vulnerabilities to many organizations at once.
• Namespace Confusion: Namespace confusion is when attackers use similar package names to trick users into downloading malicious software instead of the legitimate version.
• Backdoor: A backdoor is a hidden way to access a computer or server, bypassing normal security checks, often used by attackers to gain secret control.
• Stager: A stager is a small malware program that gains initial access to a system and prepares it for further attacks by downloading more harmful payloads.
• Reverse Shell: A reverse shell is when a hacked computer secretly connects back to an attacker, giving them remote control and bypassing standard security defenses.