A commercially available Linux backdoor called PamDOORa is being sold on a Russian cybercrime forum. It embeds inside the Linux authentication layer to silently capture plaintext passwords during SSH logins and includes anti-forensic routines capable of suppressing audit logs. No confirmed deployments have been identified yet, but the commercial model places this capability in the hands of less sophisticated attackers, increasing the probability of broad targeting across Linux server environments.