Security researchers have uncovered a sophisticated new malware family targeting enterprise environments through a supply chain compromise.

The malware, tracked as Airstalk, represents a significant shift in how attackers exploit legitimate enterprise management tools to evade detection and maintain persistent access to compromised systems.

This discovery highlights the growing vulnerability of business process outsourcing organizations and third-party vendors who manage critical infrastructure on behalf of larger enterprises.

Airstalk operates in two distinct variants, PowerShell and .NET, with both versions leveraging the AirWatch API, now known as VMware Workspace ONE Unified Endpoint Management.

The malware’s primary distinction lies in its abuse of legitimate mobile device management infrastructure to establish command-and-control communications, allowing attackers to remain invisible to traditional security monitoring systems.

This technique enables adversaries to hide malicious traffic within legitimate management API calls, effectively bypassing network-based detection mechanisms that organizations typically rely on.

Palo Alto Networks security analysts identified the malware after discovering evidence suggesting a possible nation-state threat actor deployed Airstalk through a carefully orchestrated supply chain attack.

The research team created the threat activity cluster CL-STA-1009 to track ongoing activities related to this malware family.

The malware’s sophisticated design and multi-threaded architecture suggest substantial investment in development resources, consistent with nation-state threat actors who prioritize long-term persistence over quick operational gains.

The discovered samples demonstrate advanced capabilities including data exfiltration of sensitive browser information, screenshot capture, and sophisticated persistence mechanisms.

Both variants target Google Chrome, though the more advanced .NET variant extends its reach to Microsoft Edge and Island Browser.

The malware creates a modular framework where threat actors can selectively implement or disable specific functions, providing flexibility in operations and potentially serving as a development platform for future variants.

Covert C2 Communication Through AirWatch Dead Drop Mechanism

The most innovative aspect of Airstalk involves its implementation of a dead drop communication channel using the AirWatch MDM API’s custom device attributes feature.

Rather than establishing direct connections to attacker infrastructure, the malware exchanges JSON-formatted messages through the legitimate MDM platform, effectively using enterprise management tools as intermediaries for command transmission and exfiltration.

The communication protocol operates through specific API endpoints, with the malware querying the devices endpoint (/api/mdm/devices/) to retrieve and store command information.

Messages contain required fields including CLIENT_UUID, derived from Windows Management Instrumentation data, and SERIALIZED_MESSAGE, containing Base64-encoded JSON payloads.

This design allows the malware to maintain operational security by avoiding direct network connections to suspicious infrastructure.

The C2 protocol uses message types for different operational stages, including CONNECT for initial communication, CONNECTED for acknowledgment, ACTIONS for task retrieval, and RESULT for exfiltration.

The malware also leverages the AirWatch blob upload endpoint (/api/mam/blobs/uploadblob) for transferring larger data sets, such as screenshots and stolen credentials, further obscuring malicious activity within routine management operations.

This sophisticated approach transforms trusted enterprise tools into channels for espionage, presenting organizations with an unprecedented detection challenge.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Airstalk Malware Leverages AirWatch API MDM Platform to Establish Covert C2 Communication appeared first on Cyber Security News.

A sophisticated Remote Access Trojan labeled EndClient RAT has emerged as a significant threat targeting human rights defenders in North Korea, marking another escalation in advanced malware operations attributed to the Kimsuky threat group.

This newly discovered malware represents a concerning shift in attack sophistication, utilizing stolen code-signing certificates to evade antivirus protections and bypass Windows SmartScreen warnings.

The threat was first identified when a prominent North Korean human rights activist reported suspicious activity on her compromised account, triggering a broader investigation that uncovered the campaign’s scope and technical capabilities.

The attack chain demonstrates meticulous social engineering tactics combined with legitimate-looking delivery mechanisms.

The malware arrives through a deceptively named Microsoft Installer package titled “StressClear.msi,” which had been code-signed using stolen credentials from Chengdu Huifenghe Science and Technology Co Ltd, a Chinese mineral excavation company.

The threat actors engaged in direct, methodical conversations with targeted individuals, instructing them to download and execute the MSI file.

This approach proved effective, with at least 40 confirmed targets identified across the human rights community, though the full scope of the campaign remains unknown due to minimal antivirus detection rates.

0x0v1 security analysts and researchers noted that the malware demonstrates a blend of genuine software components alongside malicious payloads, creating an intricate deception that complicates detection and analysis.

Upon execution, the MSI bundle installs a legitimate South Korean banking authentication module called Delfino from WIZVERA VeraPort, potentially serving as a decoy to establish legitimacy.

Concurrently, the installer deploys a heavily obfuscated AutoIT script wrapped within the genuine AutoIt3.exe binary, allowing the malware to execute in memory while maintaining a low profile against security tools.

The combination of trusted processes and stolen signatures essentially grants the malware unauthorized system access without triggering conventional security alerts.

Technical Persistence and Detection Evasion

The EndClient RAT employs multiple layers of persistence mechanisms designed to survive system reboots and resist removal attempts.

Once installed, the malware establishes persistence through a scheduled task named “IoKlTr” that executes every minute from the Public\Music directory.

The malware creates a globally named mutex identifier (Global\AB732E15-D8DD-87A1-7464-CE6698819E701) to prevent multiple instances from running simultaneously, preventing resource exhaustion that might trigger detection.

When the malware detects Avast antivirus presence, it generates polymorphic variations of itself by injecting garbage data and creating new filenames, demonstrating adaptive evasion capabilities.

The malware also registers a startup link that launches the malicious AutoIT payload during user login, ensuring consistent execution across restarts.

Communication with command-and-control infrastructure occurs through TCP socket connections using a custom protocol with JSON-based messaging framed by sentinel markers (“endClient9688” and “endServer9688”), allowing the malware to receive commands for shell execution, file downloads, and data exfiltration.

This technical architecture reveals sophisticated understanding of Windows internals and demonstrates how modern malware continues to abuse legitimate tools and signing mechanisms to bypass security defenses that organizations depend upon for protection.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New EndClient RAT Attacking Users by Leveraging Stolen Code-Signing to Bypass AV Detections appeared first on Cyber Security News.

The Gootloader malware campaign has resurfaced with sophisticated evasion techniques that allow it to bypass automated security analysis.

This persistent threat has been targeting victims for over five years using legal-themed search engine optimization poisoning tactics.

The malware operators deploy thousands of unique keywords across more than 100 compromised websites to lure unsuspecting users into downloading malicious ZIP archives containing JScript payloads that establish initial access for ransomware deployment.

The threat actor continues to refine their social engineering approach by using legal terminology such as “contract,” “form,” and “agreement” as bait to attract potential victims through search engines.

Once a user discovers what appears to be legitimate legal resources through search results, they are directed to compromised websites that host the malicious downloads.

The campaign’s ultimate objective remains unchanged: convincing victims to execute malicious JScript files that open the door for subsequent attacks.

Security researchers at Huntress identified this new variant during active threat hunting operations in early November 2025. The discovery revealed significant technical modifications to the malware’s delivery mechanism and persistence strategy.

The research team, led by analyst RussianPanda, documented the evolution of Gootloader’s tactics and published their findings to warn the security community about the emerging threat.

The malware’s gated content system creates a split reality where different users see entirely different web pages based on various conditions.

Users who do not meet specific criteria, such as geographic location, operating system, referrer source, or browsing time, only see harmless blog content generated through language models.

However, victims who pass these filters encounter convincing reproductions of legitimate websites featuring spoofed domain names using Cyrillic characters that visually resemble Latin letters.

ZIP Archive Manipulation Technique

The most significant innovation in this campaign involves manipulating ZIP archives to produce different extraction results depending on the tool used.

When opened with Windows Explorer, the archive extracts a valid .JS file containing the malicious payload.

However, automated analysis platforms like VirusTotal, Python’s built-in zip utilities, or 7-Zip unpack the same archive as a harmless .TXT file instead.

This clever evasion technique exploits inconsistencies in how different decompression engines interpret ZIP file structures, allowing the malware to hide from automated scanning systems while remaining functional for intended victims on Windows systems.

The persistence mechanism also evolved from scheduled tasks to a chain of .LNK shortcuts, with one placed in the user’s Startup folder pointing to another in AppData that executes a secondary JScript payload.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Gootloader is Back with New ZIP File Trickery that Decive the Malicious Payload appeared first on Cyber Security News.