Malicious PAM modules hit 0/61 on VirusTotal, evade LLM-based RE with one-line tweak
cyb3rops · x · 2026-11-06
Nextron Research reports malicious Linux PAM modules that: - Score 0/61 detections on VirusTotal (screenshot in post), only flagged by a community YARA rule in THOR APT Scanner. - Backdoor pamunix via a single line of source-code poisoning, embedding a hardcoded universal bypass password and hiding via a crafted .gnu.versionr. - Include a targeted root password (zZ,s=EB6f#91Lh@[) observed in Yemen. - Notably bypass LLM-based reverse engineering, raising doubts about AI-assisted malware analysis.
More from Safety
- Congresswoman calls to pause advanced AI and ban superintelligence; Yudkowsky backs her — ESYudkowsky · 2026-11-07
- Greenlight builds autonomous SOC on Bedrock AgentCore, 90% of 4,000 monthly cases auto-resolved — AWS ML Blog · 2026-11-07
- Paul Christiano joins OpenAI board's Safety and Security Committee, warns of intelligence explosion — teortaxesTex · 2026-11-07
- Taxbit ships a cited, permission-aware AI assistant on Bedrock AgentCore with 55% 24h return rate — AWS ML Blog · 2026-11-07
- AI plush toy for kids as young as 3 tells BBC reporter: "I can't help with killing you" — Polymarket · 2026-11-07
- Subliminal learning happens at every LoRA rank and full fine-tuning, given right learning rate — thebasepoint · 2026-11-07