Trojanized PAM/OpenSSH Credential Harvest: sshd or pam Writing Files to /tmp

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where the SSH daemon (sshd) or its related components, such as PAM libraries, create or write to files located in /tmp/ or hidden files in /var/ directories, which may indicate unauthorized configuration changes, credential manipulation, or staging of malicious files.