Automated SSH Lateral Movement via sshpass to Admin Accounts

Ibrahim Saud@tektrix

•updated Jun 22, 2026•4•0•8

Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) with disabled strict host key checking. This technique was observed in ShinyHunters attacks.