AI-Generated Scripts Hijack Linux sudo to Steal Passwords

A campaign targeting government organizations and state-linked infrastructure used AI-assisted scripts to steal credentials, maintain persistence on Linux servers and search for sensitive data, according to new research from Unit 42.

Attackers modified users’ shell startup files to intercept the sudo command. The tampered configuration captured passwords entered by users, saved them to a file controlled by the attackers, and then forwarded the password to the real sudo so the command appeared to work normally.

Unit 42’s investigation found the operation also used web shells, custom malware, mailbox searches and attempts to erase traces of activity. Collectively the tracked activity is labeled CL-UNK-1211.

The adversaries did not exploit a flaw in the sudo binary itself. Instead they placed a malicious alias into .bashrc, the file executed when a Bash shell starts. That distinction is important because applying a software patch to sudo would not remove this type of tampering. Unit 42 noted the credential interception stemmed from the modified shell configuration rather than a vulnerability in sudo.

Researchers observed activity from October 2025 through April 2026, focusing on government entities and infrastructure tied to state organizations. Unit 42 uses the “UNK” label for clusters where links to either state-backed operators or cybercriminal groups remain undetermined; the report does not attribute CL-UNK-1211 to a known actor.

Several scripts contained conversational comments and step-by-step reasoning notes that the researchers said are consistent with AI-generated code or an automated AI agent. While the evidence indicates AI helped create or adapt parts of the toolkit, it does not prove AI independently planned or executed the campaign.

Unit 42 also observed Base64-encoded commands and scripts that moved between PHP, JavaScript, Bash and Python. Those patterns may help defenders identify suspicious code, although the encodings are not definitive proof of AI involvement on their own.

How the credential interception worked

Operators replaced a user’s .bashrc with a modified copy that defined an alias for sudo. When the user invoked sudo, the alias printed a prompt that looked like the normal password request, captured the typed password, and appended it to a log file controlled by the attackers. The alias then invoked the legitimate sudo with the captured password so the command completed as expected.

The attackers named the file Solarwinds.StatusLog.txt, apparently to make it resemble a routine system artifact. Unit 42 found no evidence that SolarWinds products or infrastructure were compromised.

The shell-based credential theft was part of a broader effort. The threat actors injected code into a PHP login page to harvest administrator credentials, and they searched configuration files and shell histories for email, SMTP and database credentials. Web shells and hidden persistence mechanisms were used to maintain access—methods similar to other Linux credential-stealing campaigns, though those are separate threats and not to be conflated with CL-UNK-1211.

Malware, persistence and data exfiltration

Unit 42 identified a custom remote access Trojan written in Go, named SysGoRAT. The malware runs on Linux and Windows, communicates with command-and-control infrastructure over WebSocket, and supports remote commands, shell access, file operations and persistence. Operators disguised the binary using names such as sys-control-client, pip2.7 and ea_install. Its default C2 address in the samples was 104.194.158[.]65:443, although the operator could change that value at launch.

Attackers also deployed PHP web shells, adjusted PHP configuration so a malicious file would load before other scripts, searched government mailboxes for messages about social-media accounts, attempted to archive mailbox contents, and sought database data. Unit 42 noted one mailbox-archiving script contained a syntax error and would fail as written, illustrating that observed malicious code does not always function as intended.

To evade detection and remove traces, operators attempted to stop endpoint security processes, delete logs and shell history, remove temporary scripts after use and modify file timestamps. They also planted red-team-like markers such as RedTeamOps2025 and pentest123 to make activity appear authorized. Unit 42 reported that endpoint protections on some systems detected and blocked attempts to terminate Cortex XDR processes; that observation refers to the examined systems and does not imply every attempted action was prevented.

The campaign aligns with a broader pattern of attackers using AI to speed script development, as seen in other research on AI-generated malware. For defenders, Unit 42 recommends reviewing unexpected changes to .bashrc, PHP configuration and login pages; looking for unfamiliar aliases or credential log files; monitoring unusual outbound connections and interactive shell activity; and preserving logs and system evidence during investigations.

The indicators of compromise (IoCs) below are taken from the Unit 42 report and should be validated against local telemetry before being treated as confirmation of compromise.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal or your SIEM.

Defenders should promptly investigate unexpected changes to .bashrc, altered PHP settings or modified login pages; search for unfamiliar aliases and potential credential log files; monitor for unusual outbound connections and interactive shell sessions; and preserve logs and artifacts for forensic analysis.

Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with telemetry from SOCs to improve detection and response.