wtf is evilabigail?

EvilAbigail is a security testing tool that demonstrates what's called an "evil maid attack" against Linux laptops. The scenario it addresses: someone leaves a powered-off laptop with full disk encryption, an attacker with brief physical access boots from a USB stick, and when the legitimate user returns and types their password to log in normally, the attacker secretly captures that password and gains a remote backdoor into the system. The tool works by modifying a component called the "initrd", a small helper filesystem that Linux loads early in the boot process, before the main operating system starts. When you boot from the malicious USB, the script finds the laptop's initrd, injects code into it, and then steps back. The next time the owner boots their laptop, everything looks normal: they see their usual password prompt. But behind the scenes, the tampered initrd captures the typed password and loads a hidden backdoor that connects back to the attacker over the network. The project supports several Linux distributions including Ubuntu, Debian, Kali, Fedora, and CentOS, with slightly different techniques for each because they handle early boot differently. The README provides extensive detail on how it intercepts passwords, on Debian-based systems it taps into the password prompt, while on Red Hat-based systems it hooks into a disk-decryption function. The backdoor uses Metasploit, a well-known penetration testing framework, and the captured password can be retrieved with a simple command. This tool is aimed at security researchers, penetration testers, and IT professionals evaluating how vulnerable their fleet of encrypted laptops really is. The whole attack takes about two minutes of physical access, and the backdoor activates roughly 90 seconds after the user's normal boot. It's a concrete demonstration that full disk encryption alone isn't sufficient if an attacker can tamper with the machine between uses, a real concern for travelers, executives, or anyone who leaves laptops in hotel rooms or conference rooms. The project is transparent about its limitations: the backdoor leaves traces in system files that could be spotted by a careful administrator, and the README notes these artifacts openly rather than hiding them.