PAM API hooking

Many pieces of Linux malware hook PAM-related functions. This is often done to harvest credentials and add backdoor passwords for the attacker’s use.

---