A newly observed Monero‑mining campaign is using Linux PAM to erase its tracks and spread across user accounts on compromised servers, according to reported findings. The activity, tracked as part of the V25 (Generation 26) botnet, was first seen on 31 July 2026 and persisted through early August. Security researchers say the technique creates a forensic smokescreen that hides the miner from standard log‑based detection.
The attackers replace legitimate PAM modules with a trojanised version that abuses the pam_rootok rule, allowing them to act as any local user without needing a password, as detailed in the Group‑IB research. Once inside, they launch a modified XMRig binary that deletes its own file from disk and runs entirely in memory, leaving no trace on the filesystem. To maintain persistence they insert malicious cronjobs into each compromised account’s crontab, ensuring the miner restarts after reboots.
While operating in memory the malware also tampers with authentication and audit logs, removing entries that would reveal the illicit logins and suppressing further PAM‑based alerts, a tactic highlighted in an Infosecurity Magazine report. Process masquerading is used to make the mining threads look like harmless system utilities, further hindering behavioural monitors. Group‑IB notes that the implant does not rely on any known CVE, instead trusting the abuse of legitimate Linux mechanisms.
Although no specific threat actor has been attributed, the timing and tactics match previous supply‑chain‑focused intrusions where trusted third‑party software was tampered with to gain initial access. The campaign was active between 31 July 2026 and 5 August 2026, with observed attempts to spread laterally across multiple user accounts on the same host. Researchers warn that the technique highlights risks beyond traditional privilege‑escalation exploits, focusing on credential‑less impersonation via PAM.
Defenders should start by enabling detailed audit logging for PAM events and forwarding those logs in real time to a tamper‑proof repository, which prevents attackers from erasing their footprints. Memory forensics tools can help locate the invisible XMRig process by searching for known mining strings or unusual CPU spikes in volatile memory. Reviewing cron entries for every user, especially those with odd schedules or pointing to temporary directories, is another practical step.
Organisations should review which third‑party applications have the ability to modify PAM configuration and apply zero‑trust principles to restrict such changes to approved change‑management windows. Behaviour‑based endpoint detection that flags processes executing from memory only, or that masquerade as legitimate binaries, can catch the miner even when it avoids file‑based signatures. Finally, enforcing the principle of least privilege on user accounts limits the damage an attacker can do even if they succeed in pam_rootok abuse.