Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7) +--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445) +---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89) +---- Thread: Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor (/showthread.php?tid=6321509)

Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor - Stanley - Mar 8, 2026 Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor Cybersecurity researchers have disclosed details of a malicious Go module that's designed to harvest passwords, create persistent access via SSH, and deliver a Linux backdoor named Rekoobe. The Go module, github[.]com/xinfeisoft/crypto, impersonates the legitimate "golang.org/x/crypto" codebase, but injects malicious code that's responsible for exfiltrating secrets entered via terminal password https://thehackernews.com/2026/02/malicious-go-crypto-module-steals.html RE: Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor - W1NK1LL3RX - Mar 9, 2026 Agree, this is a serious supply chain risk because it abuses developer trust, not just a single endpoint. A fake package that steals terminal secrets and adds SSH persistence can quietly turn a normal install into long-term compromise. That’s exactly why package verification and source checking matter so much.