Most security teams treat cryptomining as a low-risk nuisance. But in a covert Linux campaign we investigated, the mining payload was never the real objective. It was the cover.
Attackers abused the Pluggable Authentication Module (PAM), a core Linux authentication component, to
