AI-Assisted Scripts Hijack Linux Sudo, Steal Credentials
Attackers are leveraging AI-generated scripts to tamper with Linux sudo commands, intercepting user passwords and deploying custom malware in a campaign targeting government entities.
A sophisticated campaign, tracked as CL-UNK-1211, has been observed targeting government organizations and state-affiliated infrastructure between October 2025 and April 2026. Threat actors are employing AI-assisted scripts to compromise Linux systems, with a primary objective of stealing user credentials and establishing persistence for further data exfiltration. The operation highlights a concerning trend where attackers are moving beyond traditional software vulnerabilities, instead manipulating system configurations to achieve their malicious goals.
The core of the attack involves tampering with the .bashrc file, a shell startup script that executes commands when a user initiates a Bash shell session. By replacing the legitimate .bashrc with a malicious version, attackers create an alias for the sudo command. When a user attempts to execute a sudo command, this alias intercepts the password prompt, captures the entered password, and logs it to an attacker-controlled file before passing it to the actual sudo command. This technique allows the attackers to steal credentials without disrupting the user's workflow, making the compromise harder to detect.
Researchers from Unit 42 identified this activity and noted that several scripts contained conversational comments and step-by-step reasoning, strongly suggesting the involvement of AI in their creation or adaptation. While AI is believed to have aided in developing parts of the toolkit, the investigation does not indicate that AI independently planned or executed the entire campaign. The attackers also utilized Base64-encoded commands and scripts written in various languages, including PHP, JavaScript, Bash, and Python, which could serve as indicators for defenders.
Beyond credential theft via sudo hijacking, the attackers expanded their operations to include other methods of data compromise. They inserted malicious code into PHP login pages to capture administrator credentials and actively searched system configurations and command histories for sensitive information such as email, SMTP, and database credentials. The attackers also deployed web shells and modified PHP configurations to ensure malicious files loaded before legitimate scripts, further embedding their presence within the compromised systems.
To maintain access and facilitate data theft, the attackers deployed a custom Go-based remote access Trojan (RAT) named SysGoRAT. This malware, capable of running on both Linux and Windows, communicates with a command-and-control (C2) server via WebSocket and supports remote command execution, shell access, file management, and persistence mechanisms. The malware was disguised with names like sys-control-client and pip2.7 to evade detection.
Efforts to conceal their presence were extensive. The attackers attempted to disable endpoint security processes, erase logs and shell history, remove temporary scripts, and alter file timestamps. In a particularly deceptive tactic, they planted red-team-like markers, such as RedTeamOps2025 and pentest123, to create the illusion of authorized activity. Despite these efforts, endpoint protections on some observed systems managed to detect and halt attempts to terminate security processes.
The campaign's reliance on AI for script generation aligns with a broader trend of threat actors leveraging artificial intelligence to accelerate their development cycles and enhance the sophistication of their attacks. For organizations, the practical response involves vigilant monitoring for unexpected changes in critical configuration files like .bashrc, scrutinizing PHP settings and login pages, identifying unfamiliar aliases or credential log files, and closely observing unusual network connections and shell activities. Preserving logs and system evidence is crucial for effective incident response and forensic analysis.