Palo Alto Networks Unit 42 has details on a spy campaign (tracked as CL-UNK-1211) that targeted government Linux servers from October 2025 to April 2026. What stands out: the attackers’ PHP and shell scripts look AI-generated.
Unit 42 says several scripts had “conversational, step-by-step reasoning notes” explaining the code to the person who asked for it. That suggests they were pasted from an AI chat or run by an AI agent.
What they did
- Swapped users’
.bashrcfor a version that steals passwords. - Injected code into PHP login pages to collect admin credentials.
- Searched config and shell history files for plaintext email, SMTP and database passwords.
- Dropped SysGoRAT, a Go remote access trojan for Linux and Windows that talks to its server over WebSocket, runs commands, takes screenshots, steals files and proxies traffic.
- Tried to kill endpoint protection, wiped logs, and planted fake “red team” markers to look like a legit pentest.
If you run PHP sites on Linux, check your login pages and shell rc files. I put together a persistence-hunting checklist in today’s how-to.
God Bless, and Happy hacking!
