[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/android-malware-poses-as-chatgpt/) * [Japanese](https://unit42.paloaltonetworks.com/ja/android-malware-poses-as-chatgpt/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Android Malware Impersonates ChatGPT-Themed Applications ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Lee Wei Yeong](https://unit42.paloaltonetworks.com/author/lee-wei-yeong/) * [Xingjiali Zhang](https://unit42.paloaltonetworks.com/author/xingjiali-zhang/) * [Yang Ji](https://unit42.paloaltonetworks.com/author/yang-ji/) * [Wenjun Hu](https://unit42.paloaltonetworks.com/author/wenjun-hu/) * [Royce Lu](https://unit42.paloaltonetworks.com/author/royce-lu/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:June 15, 2023 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Android](https://unit42.paloaltonetworks.com/tag/android/) * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/) * [Meterpreter](https://unit42.paloaltonetworks.com/tag/meterpreter/) * [Scams](https://unit42.paloaltonetworks.com/tag/scams/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/android-malware-poses-as-chatgpt/?pdf=download&lg=en&_wpnonce=40dbae5d0f "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/android-malware-poses-as-chatgpt/?pdf=print&lg=en&_wpnonce=40dbae5d0f "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Android%20Malware%20Impersonates%20ChatGPT-Themed%20Applications&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fandroid-malware-poses-as-chatgpt%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fandroid-malware-poses-as-chatgpt%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fandroid-malware-poses-as-chatgpt%2F&title=Android%20Malware%20Impersonates%20ChatGPT-Themed%20Applications "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fandroid-malware-poses-as-chatgpt%2F&text=Android%20Malware%20Impersonates%20ChatGPT-Themed%20Applications "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fandroid-malware-poses-as-chatgpt%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Android%20Malware%20Impersonates%20ChatGPT-Themed%20Applications%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fandroid-malware-poses-as-chatgpt%2F "Share in Mastodon") # Executive Summary Unit 42 researchers have observed a surge of malware written for the Android platform that is attempting to impersonate the popular ChatGPT application. These malware variants emerged along with the release by OpenAI of GPT-3.5, followed by GPT-4, infecting victims interested in using the ChatGPT tool. Here, we provide an in-depth analysis of two types of currently active malware clusters. The first cluster is a Meterpreter Trojan disguised as a "SuperGPT" app. The second is a "ChatGPT" app that sends short-text messages to premium-rate numbers in Thailand, resulting in charges for the victim that are pocketed by the threat actor. Android users can download applications written for the Android platform from a variety of places. The Google Play store is the official source, but users are also free to obtain applications from other sources such as websites or links in emails. This means there is potential for users to obtain applications that have not been vetted by Google. The files described here have been sent to Google and will be blocked from the Google Play store. Google Play Protect also protects users from apps known to contain this malware on Android devices with Google Play Services, even when those apps come from other sources. This underscores the need for users to be aware of the risks when obtaining applications for mobile devices outside of official channels. It is still possible that users could encounter malicious applications for download elsewhere on the internet. Palo Alto Networks customers with [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR), the [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) and [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) benefit from protections against the ChatGPT-themed attacks discussed in this article. Additionally, the malicious indicators (domains, URLs and hashes) can be prevented with our [DNS Security](https://docs.paloaltonetworks.com/dns-security) and [WildFire](https://docs.paloaltonetworks.com/wildfire) services. | **Related Unit 42 Topics** | [**ChatGPT**](https://unit42.paloaltonetworks.com/tag/chatgpt/), **[Meterpreter](https://unit42.paloaltonetworks.com/tag/meterpreter/), [Scams](https://unit42.paloaltonetworks.com/tag/scams/)** | |----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| # Introduction OpenAI created a tool known as Chat "Generative Pre-trained Transformer," or ChatGPT for short. This tool is powered by a large language model (LLM) and is currently in its fourth version. ChatGPT first became publicly available on Nov. 30, 2022. It quickly went viral, since it demonstrated remarkable question-answering ability, though not necessarily in an accurate manner. Threat actors are always seeking to distribute their wares via effective attack vectors, and impersonating prevalent applications according to the current global trend is among the most effective means to accomplish this objective. For instance, attackers commonly leveraged the COVID-19 pandemic to spread their own malicious versions of "Health and Wellness" category applications written for the Android platform. Past reports on [malware masquerading as a ChatGPT-related tool](https://www.sangfor.com/blog/cybersecurity/chatgpt-malware-a-new-threat-in-cybersecurity), as well as our earlier publication "[ChatGPT-Themed Scam Attacks on the Rise](https://unit42.paloaltonetworks.com/chatgpt-scam-attacks-increasing)," found that scammers were taking advantage of ChatGPT's popularity to launch attacks. Threat actors are using similarly worded domain names to trick victims into giving away personal information or downloading malware. Here, we continue to report on this trend, sharing our findings on some malicious Android applications we've recently discovered in our telemetry. Specifically, we found two types of active malware. One is a Meterpreter Trojan disguised as a "SuperGPT" app, and the other is a "ChatGPT" app that sends messages to premium-rate numbers in Thailand. # Meterpreter Trojan Our team uncovered a malicious Android Package Kit (APK) sample, which turned out to be a Trojanized version of a legitimate application. The legitimate application is an AI assistant based on the latest version of ChatGPT. The malicious version of this application enables the actor to establish remote access to an Android device if exploitation is successful. Table 1 describes the legitimate application and Table 2 shows the malicious application. |----------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Application name** | SuperGPT - AI with GPT-4 | | **Description (** [**summarized from the official listing**](https://play.google.com/store/apps/details?id=com.dominapp.supergpt)**)** | A GPT-4 powered AI assistant, able to perform tasks such as: \* writing emails, \* answering questions, \* and writing articles Also comes equipped with the following capabilities: \* speech recognition \* language translation | | **Package name** | com.dominapp.supergpt | | **Version name (code)** | 1.2 (8) | | **SHA-256 hash** | d7ef8929b236a43917f351c39963916c1dd3a9c0580499443322750435245f9f | | **File size** | 10.85 MB (11,378,336 bytes) | *Table 1. Metadata of the legitimate application.* The MainActivity class of the malware sample contains a String variable reference to the official ChatGPT URL [https://chat.openai.com/chat](https://chat.openai.com/chat). Package-Class named v3.v is a custom WebViewClient class implementation (WebView is Android's built-in implementation to embed web browser functionality in apps made for its operating system). As such, this Java class is able to extend or override the default functionality. It does so by adding the following redirect rules: 1. Redirect to [https://chat.openai.com/chat](https://chat.openai.com/chat), if URL contains [https://openai.com/blog/chatgpt/](https://openai.com/blog/chatgpt/) 2. Redirect to [https://chat.openai.com/chat](https://chat.openai.com/chat) after a 1,000 millisecond delay, if URL contains [beta.openai.com/](https://beta.openai.com/) |--------------------------|----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Application icon** || **Screenshot** | | ![Image 1 is the application icon for SuperGPT. It is the head of a blue robot using headphones attached to a voice mic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/image4.png) ic\_launcher.png (app icon) || ![Image 2 is a screenshot of the SuperGPT app. The SuperGPT logo appears on top with the header “Talk with AI” followed by the text, “You can ask any question in your language and receive a response with a human-like voice powered by GPT-3.” At the bottom there is a button that says get started.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/image7.png) App screenshot | | **Application name** | SuperGPT || | **SHA-256 hash** | af19ca9213a20263c30584a2bf260dcdb3b4eafa4f43af10824af781573a2314 || | **File size** | 12.39 MB (12,994,395 bytes) || | **Programming language** | Kotlin || | **Version name (code)** | 1.2 (8) || | **Package name** | com.dominapp.supergpt || | **Main activity** | com.dominapp.supergpt.activities.MainActivity || | **Android version** | Minimum: | API level 23 (Android 6) | | **Android version** | Target: | API level 32 (Android 12L) | *Table 2. Metadata of the malicious APK sample.* According to VirusTotal (VT), this sample was first submitted through VT's web interface from Nicaragua (NI), on 2023-03-16 02:06:04 UTC, as filename 2021id.apk. ## Payload Implantation Comparing the differences between the legitimate and malicious APK samples, it is clear that the critical Trojanizing addition to the file is the following line of Smali language code (shown in Figure 1). ![Image 3 is a screenshot of Smali code. The added, malicious line of code is bolded.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128648-3.png) Figure 1. Added line of malicious Smali language code. The core threat in this malware sample is known as "Meterpreter." It is created using the Metasploit framework. The source code of the initial Java-based Android Meterpreter stager can be found on [Rapid7's GitHub repository](https://github.com/rapid7/metasploit-payloads/tree/master/java/androidpayload/app/src/com/metasploit/stage). The main functionality is implemented within the Payload class. The Payload class' start method is invoked by the MainService class. The MainService class, in turn, can be either: * Started by the MainActivity class * Started by the MainBroadcastReceiver class automatically upon completion of the device boot sequence The Payload class' main method is responsible for performing the following sequence of actions: 1. Parse the hard-coded exploit configuration stored in the configBytes byte array (shown in Figure 2). * Note: This is not obfuscated in any way (e.g., the TCP or HTTP remote host address and port are clearly visible) 2. Ensure the Android device's central processing unit (CPU) remains on via the Power Manager system service's partial wake lock functionality. 3. Hide the icon's application if requested. 4. Establish a socket connection to the author-managed remote host. 5. Download a secondary payload upon successful connection, implementing the full range of capabilities (e.g., the dump\_sms command). In the case of the APK malware sample in question, the following sequence of operations triggers this Meterpreter payload: 1. The service named com.dominapp.supergpt.eluad.Vojnd starts upon the BOOT\_COMPLETED action, as declared in the AndroidManifest.xml file. 2. The thread named com.dominapp.supergpt.eluad.C2094e spawns and runs. 3. The main method of the package class named com.dominapp.supergpt.eluad.Dapjs is invoked. ![Image 4 is a screenshot of a configuration byte array that is characteristic of a Meterpreter payload.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128648-4.png) Figure 2. Configuration byte array, characteristic of a Meterpreter payload. The Meterpreter payload is configured to connect to the remote endpoint tcp\[://\]Gwdidkfkf-47070\[.\]portmap\[.\]io:47070. [Portmap.io](https://portmap.io) is a service that performs port forwarding free of charge. ## Certificate Attribution The digital code-signing certificate used to sign this sample belongs to the attacker with the following characteristics: * Email address -- lkpandey950@gmail\[.\]com * Organization Common Name (CN) -- Hax4Us * Located in Shahdara, Delhi, India * The certificate is valid from 2020-07-17 11:08:41 UTC to 2047-12-02 11:08:41 UTC * Serial number -- 1a505d53b1c75046a81acb021fdb5f99936b75db * SHA-1 thumbprint -- 65094A64233F818AEF5A4EDE90AC1D0C5A569A8B This certificate is attached to over a hundred other publicly shared malware samples on VT (as shown in Figure 3). ![Image 5 is a screenshot of a VirusTotal search query. The columns include detections, size, and when the samples were first seen. The samples also include tags, such as android, obfuscated, reflection, telephony, and so on.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128648-5.png) Figure 3. Snapshot of partial results for VT search query androguard:"C:IN, CN:hax4us, L:shahdara, O:hax4us, ST:delhi, email:lkpandey950@gmail\[.\]com." In contrast, the legitimate application is digitally signed with a generic certificate. # SMS to Premium-Rate Numbers We've also uncovered another cluster of APK malware samples. On the surface, the malware seems to be presenting the following webpage (shown in Figure 4) containing a description of ChatGPT. But in fact, this threat conceals a sinister intent underneath. ![Image 6 as a screenshot of an article about ChatGPT on a webpage, titled ChatGPT: optimizing language models for dialogue. There is an image of a robot head with the words, ChatGPT on it, and then the article goes into details about what ChatGPT is.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128648-6.png) Figure 4. ChatGPT: Optimizing Language Models for Dialogue. hxxps\[://\]apkafe\[.\]com/what-is-chatgpt. ![Image 7 is the OpenAI logo and logotype.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128648-7.png) Figure 5. OpenAI logo and logotype. Moreover, all these APK samples share the OpenAI logo often associated with ChatGPT (shown in Figure 5) as their application icon, adding to the deceptive narrative that this application is related to the ChatGPT AI tool. These APK malware samples are capable of sending SMS messages to premium-rate numbers in Thailand (TH). Premium-rate numbers cost more than calls to normal phone numbers, in exchange for rendering some sort of service (e.g., users providing information). The business behind it collects the earnings, but this can also be abused to conduct scams and fraudulent activity. For reference, the official [Android Open Source Project (AOSP) codebase](https://android.googlesource.com/platform/frameworks/base/+/master/core/res/res/xml/sms_short_codes.xml#258) contains a list of premium-rate numbers by country. The Android permission to send SMS text messages, android.permission.SEND\_SMS, is requested by the application, and a reference to the "country":"thailand" is passed as a ContentValue. The samples also make use of [OneSignal](https://onesignal.com), a service that enables apps to send messages via push notifications, including by email, SMS and within the app itself. For instance, the configuration obtained from the URL hxxps\[://\]api\[.\]onesignal\[.\]com/apps/**af63b434-ec50-46a0-9374-d57a383f2e03**/android\_params\[.\]js is reproduced below: *(The OneSignal app ID is* ***af63b434-ec50-46a0-9374-d57a383f2e03***\*)\* { "awl\_list": {}, "android\_sender\_id": "**660194064544** ", "chnl\_lst": \[\], "outcomes": { "direct": { "enabled": false }, "indirect": { "notification\_attribution": { "minutes\_since\_displayed": 60, "limit": 10 }, "enabled": false }, "unattributed": { "enabled": false } }, "receive\_receipts\_enable": false } The formatted phone number in the android\_sender\_id field value is **+661-9406-4544**. These APK samples are digitally signed with a generic certificate. As for other key attributes, their values are depicted in Table 3 below. |------------------------|----------------------------------------------------------------| | **Validity** | From 2008-02-29 01:33:46 UTC To 2035-07-17 01:33:46 UTC | | **Serial number** | 936eacbe07f201df | | **Thumbprint (SHA-1)** | 61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81 | *Table 3. Code-signing certificate attributes for Type II APK samples.* This cluster of samples can be subdivided into two smaller batches, each sharing some common characteristics. APK samples in the first batch send an SMS text message to one hard-coded, premium-rate Thai number and make use of the OneSignal service. APK samples in the second batch send different SMS text messages to two other hard-coded, premium-rate Thai numbers, and they do not obtain configuration from an external OneSignal endpoint. The APK samples belonging to the first batch have a lower version compared to those from the second. This suggests that the first batch could be an earlier iteration of malware development than the second. This theory is supported by the earlier "first submission" timestamp of these APK samples on VT: batch one (February 2023), followed by batch two (March 2023). ## Batch One These are the SHA-256 hashes of samples in this batch: * 2980329fa5eaed0f5625e961572f7ae8136ca7df30cca9e9c8783c827627b692 * 391e8f394af425f1e7edff6aea1605aa89f2fb0233c44e70cff265fc60ec3b1b * d1844bf3865c7d2e4745baa2496297937821171d7a3ad4412b0a4e767bc32b5e * d1b1813f7975b7117931477571a2476decff41f124b84cc7a2074dd00b5eba7c Table 4 below summarizes the static attributes of samples in this batch. |---------------------------------------------|---|---| | **Package names** | \* com.chatgpt.tl \* com.gg.gptchatt \* com.chatgpt.go \* com.chatgpt.ogothai || | **Main activities** | \* chatgpt.subth.MainActivity \* tikitaka.sub.MainActivity || | **Version name (code)** | chatgpt (183) || | **Android version** | Minimum: API level 18 (Android 4.3) || | **Android version** | Target: API level 30 (Android 11) || | **Tags** | \* GTA\_TT \* ChatGPT || | **First submission timestamps on VT (UTC)** | Between 2023-02-02 08:37:23 and 2023-02-07 03:08:33 || | ***OneSignal configuration*** ||| | **App ID** | af63b434-ec50-46a0-9374-d57a383f2e03 || | **Android sender ID** | +661-9406-4544 || *Table 4. Static attributes of batch one APK samples.* ## Batch Two These are the SHA-256 hashes of samples in this batch: * b787d5ef4a0c350a9f62f55907c8ef6d92bf7699b8544fabff5a263e52a2d0d1 * be757541584cc2dc2e7adacf7a5186be07d474f06c8698a938589f86ce56ea34 * e9bb6d04d796eb147b9d73a7df91fb9e6a99e0be8a41a61329d600a9dfe8b1ae Table 5 below summarizes the static attributes of samples in this batch. |--------------------------------------------|---|---| | **File size** | 1.249 MB (1,309,619 bytes) || | **Package name** | com.chatgpt.ggmmtlan || | **Main activity** | ggtlan.sub.MainActivity || | **Version name (code)** | chatgpt (200) || | **Android version** | Minimum: API level 22 (Android 5.1) || | **Android version** | Target: API level 30 (Android 11) || | **First submission timestamp on VT (UTC)** | **SHA-256 hash** || | 2023-03-08 22:16:21 | be757541584cc2dc2e7adacf7a5186be07d474f06c8698a938589f86ce56ea34 || | 2023-03-10 12:00:23 | e9bb6d04d796eb147b9d73a7df91fb9e6a99e0be8a41a61329d600a9dfe8b1ae || | 2023-03-17 10:19:14 | b787d5ef4a0c350a9f62f55907c8ef6d92bf7699b8544fabff5a263e52a2d0d1 || *Table 5. Static attributes of Batch 2 APK samples.* # Conclusion The emergence of ChatGPT-themed APK malware poses a severe threat to the security and privacy of mobile devices. These types of malware can potentially steal sensitive information, spy on user activities and cause significant financial losses for unsuspecting victims. To protect themselves against this type of malware, mobile users should take proactive measures, such as installing reputable antivirus software, being cautious when downloading apps from third-party sources and keeping their devices up to date with the latest security patches. Overall, the threat of mobile malware highlights the critical importance of mobile device security. By remaining vigilant and taking proactive steps to safeguard our devices, we can help prevent the spread of this dangerous malware and protect ourselves from potential harm. Palo Alto Networks customers with [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR), the [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) and [WildFire](https://docs.paloaltonetworks.com/wildfire) benefit from protections against the attacks discussed in this article. Additionally, the malicious indicators (domains, URLs and hashes) can be prevented with our [DNS Security](https://docs.paloaltonetworks.com/dns-security) and [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) services. If you think you might have been impacted or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * **North America Toll-Free**: +1.866.486.4842 (+1.866.4.UNIT42) * **UK**: +44.20.3743.3660 * **EMEA**: +31.20.299.3130 * **APAC**: +65.6983.8730 * **Japan**: +81.50.1790.0200 ## Indicators of Compromise |--------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Category** | **SHA-256 hashes** | | APK malware samples Type I | \* af19ca9213a20263c30584a2bf260dcdb3b4eafa4f43af10824af781573a2314 | | APK malware samples Type II | *Batch One* \* 2980329fa5eaed0f5625e961572f7ae8136ca7df30cca9e9c8783c827627b692 \* 391e8f394af425f1e7edff6aea1605aa89f2fb0233c44e70cff265fc60ec3b1b \* d1844bf3865c7d2e4745baa2496297937821171d7a3ad4412b0a4e767bc32b5e \* d1b1813f7975b7117931477571a2476decff41f124b84cc7a2074dd00b5eba7c | | APK malware samples Type II | *Batch Two* \* b787d5ef4a0c350a9f62f55907c8ef6d92bf7699b8544fabff5a263e52a2d0d1 \* be757541584cc2dc2e7adacf7a5186be07d474f06c8698a938589f86ce56ea34 \* e9bb6d04d796eb147b9d73a7df91fb9e6a99e0be8a41a61329d600a9dfe8b1ae | | URL | \* hxxps\[://\]api\[.\]onesignal\[.\]com/apps/af63b434-ec50-46a0-9374-d57a383f2e03/android\_params\[.\]js \* tcp\[://\]Gwdidkfkf-47070\[.\]portmap\[.\]io | | Certificate Thumbprint (SHA-1) | \* 65094A64233F818AEF5A4EDE90AC1D0C5A569A8B | ## MITRE ATT\&CK TTPs |--------|-----------------------------------|-------------------------------------------------------------------------------------| | **ID** | **Technique** | **Description** | | T1582 | SMS Control | APK malware samples are capable of sending SMS to Premium-rate Numbers in Thailand. | | T1623 | Command and Scripting Interpreter | APK malware samples are capable of providing Meterpreter shell access. | ## Additional Resources * [ChatGPT Malware: A New Threat in Cybersecurity](https://www.sangfor.com/blog/cybersecurity/chatgpt-malware-a-new-threat-in-cybersecurity), Sangfor Technologies * [Into Android Meterpreter and how the malware launches it --- part 2](https://medium.com/p/ef5aad2ebf12), Medium * [ChatGPT-Themed Scam Attacks Are on the Rise](https://unit42.paloaltonetworks.com/chatgpt-scam-attacks-increasing), Unit 42, Palo Alto Networks Back to top ### Tags * [Android](https://unit42.paloaltonetworks.com/tag/android/ "Android") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [Meterpreter](https://unit42.paloaltonetworks.com/tag/meterpreter/ "Meterpreter") * [Scams](https://unit42.paloaltonetworks.com/tag/scams/ "Scams") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Inside Win32k Exploitation: Background on Implementations of Win32k and Exploitation Methodologies](https://unit42.paloaltonetworks.com/win32k-analysis-part-1/ "Inside Win32k Exploitation: Background on Implementations of Win32k and Exploitation Methodologies") ### Table of Contents * ### Related Articles * [Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "article - table of contents") * [Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ "article - table of contents") * [Threat Brief: Recruiting Scheme Impersonating Palo Alto Networks Talent Acquisition Team](https://unit42.paloaltonetworks.com/phishing-attackers-pose-as-panw-recruiters/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)