Check your PAM! Detected PAM steal module using in the wild
lab.onsec.ru