Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor in Developer Environments

Recent reports indicate that malicious actors are exploiting the Go open-source ecosystem by deploying a backdoored crypto module. This module is designed to steal passwords and install a Rekoobe Linux backdoor on developer and CI environments.

The package impersonates Go's trusted cryptography library to transform ordinary password prompts into a complete compromise chain without detection.

The module appears as a standard cryptography library on pkg.go.dev , with familiar folders like argon2 , bcrypt , and ssh , aiding its integration into dependency graphs.

The threat actor has included a dependency on the legitimate github.com/bitfield/script module to facilitate HTTP calls and shell execution, making the surrounding codebase appear routine.

The Socket Research Team identified a fake module, GitHub.com/xinfeisoft/crypto , designed to mimic the legitimate golang.org/x/crypto repository structure and subpackages.

When an application calls the malicious ReadPassword function, it captures the user's typed secret and writes the plaintext password to /usr/share/nano/.lock , an unusual location repurposed for storing harvested credentials. This backdoored ReadPassword function is integrated into ssh/terminal/terminal.go , making it an attractive point for harvesting high-value secrets like SSH keys, database passwords, and API tokens.

The module fetches a GitHub Raw "update" page to obtain a staging URL, exfiltrates the password via HTTP POST, and executes attacker-provided shell content via /bin/sh . The backdoor remains dormant during automated test runs and low-coverage scans, triggering only during real interactive password entry.

The shell script retrieved acts as a Linux stager, preparing the host and delivering additional payloads. It appends an attacker-controlled SSH key to /home/ubuntu/.ssh/authorized_keys , sets iptables default policies to ACCEPT , and downloads two binaries from img.spoolsv.cc disguised with .mp5 extensions. After execution, the script deletes the temporary files to reduce on-disk artifacts.

Analysis shows that sss.mp5 communicates over TCP 443 with 154.84.63.184 , while 555.mp5 is identified as a Rekoobe Linux backdoor, associated with espionage activities.

The xinfeisoft GitHub account hosts four repositories, with crypto providing the backdoored module and vue-element-admin supplying the GitHub Raw pointer file used in staging. The commit history indicates ongoing maintenance of the staging URL, suggesting a continuous campaign.

Socket reports that as of early 2026, the public Go module proxy blocks github.com/xinfeisoft/crypto as malicious, reducing exposure. However, environments that previously vendored or cached the module remain at risk if the code is still present in builds.

Socket’s AI Scanner flags the package as known malware due to the backdoored ReadPassword path and its network-scripting behavior. Defenders are advised to monitor Go module roots as supply chain boundaries and scrutinize changes to go.mod and go.sum .

Category Details

Malicious Go Module github[.]com/xinfeisoft/crypto

Threat Actor GitHub Account github[.]com/xinfeisoft

GitHub-Hosted Configuration https://raw.githubusercontent[.]com/xinfeisoft/vue-element-admin/refs/heads/main/public/update[.]html

Payload Delivery Endpoints

https://img.spoolsv[.]cc/seed.php

https://img.spoolsv[.]net/seed.php (historical)

Related Domains

img.spoolsv[.]cc

spoolsv[.]cc (parent domain, likely related)

spoolsv[.]net (parent domain, likely related)

Network Indicators 154[.]84[.]63[.]184

Payload SHA256 Hashes

sss.mp5: 4afdb3f5914beb0ebe3b086db5a83cef1d3c3c4312d18eff672dd0f6be2146bc

555.mp5: 8b0ec8d0318347874e117f1aed1b619892a7547308e437a20e02090e5f3d2da6

Based on reporting by GBHackers.