A group of hackers exploited vulnerabilities in Linux shell configurations to secretly intercept administrative passwords. Unit 42, part of Palo Alto Networks, identified this activity as CL-UNK-1211, which occurred from October 2025 through April 2026. The attackers combined credential theft, web shells, and custom malware to gather intelligence.

Sudo Hijacking Steals Passwords The attackers replaced the victim's .bashrc file with a modified copy that included a credential-stealing command. When an affected user entered sudo, the malicious alias intercepted the interaction and saved the provided password in an attacker-controlled log file named Solarwinds.StatusLog.txt, presumably to mimic legitimate SolarWinds activity. These artifacts suggest that the payloads were created using large language models or deployed through an automated AI agent.

They attempted to package complete mailboxes for theft, though one examined the archive script contained syntax errors and would fail. They transferred database contents to local files and attempted to move compressed archives outside of compromised networks. The findings underscore the significance of monitoring across Linux servers, databases, and email systems, where attackers combined password interception, persistent access, and evidence removal in the same campaign.