Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords

A campaign against government organizations and state-linked infrastructure used AI-assisted scripts to steal credentials, maintain access to Linux servers and seek sensitive data, according to new research.

The attackers altered users’ shell startup files to intercept the sudo command, then copied entered passwords to a file while passing them to the real command.

This let a user’s request appear to work normally as the password was stolen. Unit 42’s investigation says the activity also involved web shells, custom malware, mailbox searches and attempts to erase evidence.

The operation shows how familiar Linux tools can be turned against their users. Rather than exploiting a flaw in sudo itself, the attackers planted a malicious alias in .bashrc, a file that runs commands when a user starts a Bash shell.

The distinction matters: applying a software patch alone would not remove this kind of tampering. Administrators may find this earlier Linux sudo vulnerability useful context, but Unit 42 described credential interception through a changed shell configuration, not that vulnerability.

Researchers from Unit 42 identified the activity and track the group of related operations as CL-UNK-1211. They observed activity from October 2025 to April 2026 targeting government entities and state-affiliated infrastructure.

Unit 42 uses “UNK” for clusters whose links to either state-backed activity or cybercrime have not been determined, so the findings do not identify a known government or criminal group as responsible.

Several scripts contained conversational comments and step-by-step reasoning notes that researchers said were consistent with AI-generated code or an automated AI agent.

The evidence points to AI helping create or adapt parts of the toolkit; it does not establish that AI independently planned or carried out the campaign.

Unit 42 also noted Base64-encoded commands and scripts that moved between PHP, JavaScript, Bash and Python. These clues may help defenders spot suspicious code, but they are not proof of AI use on their own.

Hackers Use AI-Generated Scripts

The attackers replaced a user’s .bashrc with a modified copy containing an alias for sudo. When the user ran the command, the alias displayed a prompt resembling the normal password request, captured the password and wrote it to an attacker-controlled log file.

It then passed the password to the legitimate sudo command, making the interception less obvious. The attackers named the file Solarwinds.StatusLog.txt, apparently to make it look like a routine system artifact. Unit 42 said it found no evidence that SolarWinds systems or infrastructure were compromised.

The credential theft did not stop at the shell. Attackers also inserted code into a PHP login page to collect administrator usernames and passwords, and searched configuration files and command histories for email, SMTP and database credentials.

The campaign’s use of web shells and hidden access has parallels with other Linux credential-stealing malware, though that article describes a separate threat and should not be confused with CL-UNK-1211.

Malware, persistence and data theft

Unit 42 found a custom Go-based remote access Trojan it named SysGoRAT. The malware can run on Linux and Windows, communicate with a command-and-control server over WebSocket and support remote commands, shell access, file handling and persistence.

Attackers used names such as sys-control-client, pip2.7 and ea_install to disguise the binary. Its default C2 address was 104.194.158[.]65:443, though the report says operators could change it at launch.

The attackers also deployed web shells and changed PHP configuration so a malicious file would load before other PHP scripts. They searched government mailboxes for messages related to social media accounts, attempted to package mailbox contents and sought database data.

Unit 42 reported that one mailbox-archiving script contained a syntax error and would fail as written. The finding is a reminder that observed malicious code does not always work as intended.

To hide their presence, operators tried to stop endpoint security processes, delete logs and shell history, remove temporary scripts after use and change file timestamps.

They also planted red-team-like markers, including RedTeamOps2025 and pentest123, to make activity appear authorized. Unit 42 said endpoint protections detected and stopped attempts to terminate Cortex XDR processes; that result concerns the observed systems and does not mean every attempted activity was blocked.

The campaign fits a broader pattern of attackers using AI to speed up script development, as seen in other AI-generated malware research.

For defenders, the practical response is to review unexpected changes to .bashrc, PHP settings and login pages; check for unfamiliar aliases or credential log files; monitor unusual outbound connections and shell activity; and preserve logs and system evidence during an investigation.

The indicators below are from Unit 42’s report and should be checked against local telemetry before being treated as evidence of compromise.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.