Researchers have identified a malicious Go module, github.com, designed to harvest passwords and deploy the Rekoobe backdoor. Disclosed on February 27, 2026, the module impersonates the legitimate golang.org/x/crypto library to deceive developers into including it in their projects.

Malicious Mechanics

The attack utilizes “namespace confusion” by exploiting the fact that the legitimate Go crypto project treats GitHub only as a mirror, while the canonical source is GoogleSource.

• Password Harvesting: The module injects code into ssh/terminal/terminal.go to hook the ReadPassword path. It captures credentials at the moment of entry, before they can be hashed or encrypted by the application.
• Persistence: Stolen secrets are written to /usr/share/nano/.lock for local persistence and then exfiltrated via HTTP POST to a remote endpoint.
• Staging: It uses a GitHub-hosted “update” page as a staging mechanism to fetch secondary payloads and execute shell commands via /bin/sh.

Rekoobe Backdoor Details

The final stage of the infection is the deployment of Rekoobe, a sophisticated Linux trojan.

• Capabilities: Rekoobe can receive remote commands to download additional payloads, steal files, and execute reverse shells.
• Origin: It is based on the open-source Tiny SHell codebase but features enhanced encryption and process masquerading (e.g., disguising itself as /bin/bash) to evade detection.
• Threat Actor: The malware is historically linked to the Chinese state-sponsored group APT31 (also known as Zirconium).