Unsigned PAM module implanted in su/sudo auth stack with non-package-manager pam.d tampering

Duo Tech@duotech

•updated Aug 14, 2026•1•0•4

Detects an unsigned/unexpected PAM module written into the su/sudo authentication stack, correlated with non-package-manager modification of /etc/pam.d/ configuration and subsequent su/sudo activity — the technique Jewelbug's Linux tooling uses to steal credentials.