Velvet Ant PAM Module Tampering via Unauthorized File Write to Security SO Paths

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the creation or modification of shared object (.so) files within critical Linux PAM library directories (/lib/security/, /lib64/security/, /usr/lib/security/) by processes other than identified system package managers. This behavior is indicative of an adversary replacing legitimate authentication modules with malicious versions to capture credentials or establish persistence, such as the activity documented in Operation Highland (Velvet Ant).