Malicious Go Crypto Module Steals Passwords and Deploy Rekoobe Backdoor in Developer Environments

Malicious Go Crypto Module Threatens Developer Environments

A newly identified supply chain attack threatens Go developers. A malicious Go module, closely resembling the trusted cryptographic library golang.org/x/crypto, has been used to steal passwords and deploy a Linux backdoor in compromised systems.

The module, github[.]com/xinfeisoft/crypto, was publicly listed on pkg.go.dev at version v0.15.0 with a publication date of Thu, Feb 20, 2025. It mimics the structure of the legitimate golang.org/x/crypto repository, including subpackages like bcrypt, argon2, acme, and ssh, to avoid suspicion.

The attack exploits Go's use of GitHub as a mirror for the canonical go.googlesource.com/crypto repository, making the malicious module appear routine during code reviews.

Socket.dev researchers discovered the backdoor embedded inside ssh/terminal/terminal.go, targeting the ReadPassword helper function used by tools handling SSH passphrases, database logins, and API keys. The backdoor activates during live interactive use, avoiding detection during automated test runs.

When ReadPassword is called, it captures credentials in plaintext, writes them to /usr/share/nano/.lock, and posts them to a dynamically resolved endpoint. It subsequently retrieves and executes a shell script via /bin/sh. This setup allows attackers to rotate infrastructure URLs without republishing the module. The Go security team has since blocked the module at the public proxy, returning a 403 SECURITY ERROR response.

Teams working in Go-based Linux environments, especially those running cloud VMs, CI/CD runners, or admin bastions, are significantly impacted. Any application importing this module and invoking ReadPassword becomes a live credential harvesting point, exposing SSH passphrases, database passwords, and API keys.

The Multi-Stage Backdoor Delivery Chain

The execution chain progresses from the backdoored ReadPassword hook through GitHub Raw pointer (update.html), a staging server (img[.]spoolsv[.]cc), and final Rekoobe backdoor delivery.

After the initial script execution, a five-stage Linux dropper chain begins. The backdoored ReadPassword function fetches update.html from the attacker's GitHub repository, redirecting to seed.php at img[.]spoolsv[.]cc. This endpoint returns a curl | sh launcher that fetches and executes snn50.txt, the primary Linux stager preparing the host and delivering the final payloads.

The snn50.txt stager performs three critical actions: it appends a threat actor-controlled SSH key to /home/ubuntu/.ssh/authorized_keys for persistent remote access, sets iptables default policies to ACCEPT, and downloads sss.mp5 and 555.mp5 from img[.]spoolsv[.]cc, executing and deleting them to minimize forensic evidence.

The 555.mp5 is confirmed as a Rekoobe Linux backdoor, communicating over TCP port 443 without a standard TLS handshake. The sss.mp5 functions as a loader and reconnaissance component.

Defenders should audit go.mod and go.sum files for unexpected module root changes and treat new dependency additions as security review items. Monitoring endpoints for writes to /usr/share/nano/.lock, unauthorized authorized_keys modifications, and iptables policy resets to ACCEPT will aid in early detection. Blocking img[.]spoolsv[.]cc and img[.]spoolsv[.]net, and alerting on processes chaining GitHub Raw fetches with outbound HTTP POST calls, will help detect suspicious activity.

Based on reporting by Cyber Security News.