Linux XMRig Botnet Abuses PAM for Fileless Monero Mining and Persistent Access

A covert Monero (XMR) cryptomining campaign uncovered in May 2026 is abusing Linux Pluggable Authentication Modules (PAM) to evade detection, maintain filele...