[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/axios-supply-chain-attack/)
* [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/axios-supply-chain-attack/)
* [French](https://unit42.paloaltonetworks.com/fr/axios-supply-chain-attack/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/axios-supply-chain-attack/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/ "High Profile Threats")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# Threat Brief: Widespread Impact of the Axios Supply Chain Attack

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read  
Related Products  
[![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Cloud](https://unit42.paloaltonetworks.com/product-category/cortex-cloud/ "Cortex Cloud")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Unit 42](https://unit42.paloaltonetworks.com/author/unit42/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:April 1, 2026

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/)
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [API attacks](https://unit42.paloaltonetworks.com/tag/api-attacks/)
  * [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/)
  * [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/)
  * [Supply chain](https://unit42.paloaltonetworks.com/tag/supply-chain/)
  * [Trojan](https://unit42.paloaltonetworks.com/tag/trojan/)
  * [VBScript](https://unit42.paloaltonetworks.com/tag/vbscript/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/axios-supply-chain-attack/?pdf=download&lg=en&_wpnonce=081080d8c3 "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/axios-supply-chain-attack/?pdf=print&lg=en&_wpnonce=081080d8c3 "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Threat%20Brief:%20Widespread%20Impact%20of%20the%20Axios%20Supply%20Chain%20Attack&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Faxios-supply-chain-attack%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Faxios-supply-chain-attack%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Faxios-supply-chain-attack%2F&title=Threat%20Brief:%20Widespread%20Impact%20of%20the%20Axios%20Supply%20Chain%20Attack "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Faxios-supply-chain-attack%2F&text=Threat%20Brief:%20Widespread%20Impact%20of%20the%20Axios%20Supply%20Chain%20Attack "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Faxios-supply-chain-attack%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Threat%20Brief:%20Widespread%20Impact%20of%20the%20Axios%20Supply%20Chain%20Attack%20https%3A%2F%2Funit42.paloaltonetworks.com%2Faxios-supply-chain-attack%2F "Share in Mastodon")

## Executive Summary

Unit 42 stopped monitoring this threat and updating the brief on May 19, 2026. Please [refer to the npm website](https://docs.npmjs.com/packages-and-modules/securing-your-code) for the latest information.

Unit 42 researchers have observed widespread impact from the significant supply chain attack targeting the Axios JavaScript library. The attack occurred after an Axios maintainer's npm account was hijacked, leading to the release of malicious updates (versions v1.14.1 and v0.30.4).

These compromised versions introduced a hidden dependency called plain-crypto-js. This dependency is a cross-platform remote access Trojan (RAT) capable of affecting Windows, macOS and Linux systems. The malware was designed to perform reconnaissance and establish persistence, with an added feature to self-destruct for evasion.

Axios is a popular, promise-based HTTP client library for JavaScript, used to make API requests in browsers and Node.js. It features automatic JSON data transformation, request/response interception and request cancellation, making it a standard tool for connecting frontend apps to backend services.

Analysis of malware that the attackers used overlaps with operations [previously reported to involve](https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering) the Democratic People's Republic of Korea (DPRK).

This campaign has affected the following sectors in the U.S., Europe, Middle East, South Asia and Australia:

* Business services
* Customer Service
* Financial services
* High tech
* Higher education
* Insurance
* Media and entertainment
* Medical equipment
* Professional and legal services
* Retail services

This article recommends a number of [mitigations for the attack](#post-176776-_6kajjrwpgjuu).

Palo Alto Networks customers are better protected from the threats discussed in this article through the following products and services:

* [Advanced URL Filtering](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/url-filtering-features/advanced-url-filtering) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security)
* [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration)
* [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire)
* [Cortex AgentiX](https://www.paloaltonetworks.com/cortex/agentix)
* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)
* [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM)

The [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.

| **Related Unit 42 Topics** | [**Supply Chain**](https://unit42.paloaltonetworks.com/tag/supply-chain/), **[High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/)** |
|----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|

## Details of the Axios Supply Chain Attack

The attacker published two compromised versions of Axios (v1.14.1 and v0.30.4) but they did not modify any of the Axios source code. Instead, they injected plain-crypto-js@4.2.1 into the package.json file as a runtime dependency.

### The Postinstall Dropper

With compromised versions of Axios, when a developer runs npm install axios, npm automatically resolves the dependency tree and installs plain-crypto-js. This triggers npm's postinstall lifecycle hook, executing a heavily obfuscated Node.js dropper script named setup.js in the background.

To obfuscate its operations, setup.js uses a two-layer encoding scheme involving string reversal, Base64-decoding and an XOR cipher using the key OrDeR\_7077.

### Fetching Platform-Specific Payloads

The dropper queries the operating system and sends an HTTP POST request to a command-and-control (C2) server at sfrclak\[.\]com:8000. To make this outbound traffic look like benign npm registry requests, it appends platform-specific paths:

* packages.npm\[.\]org/product0 for macOS
* packages.npm\[.\]org/product1 for Windows
* packages.npm\[.\]org/product2 for Linux

Figure 1 shows the commands for this first-stage download.
![Code snippets of commands for each operating system: macOS, Windows, and Linux.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/word-image-257931-176776-1.png) Figure 1. First stage download per platform.

### Execution of the RAT

The C2 server delivers a different payload depending on the victim's operating system:

* **macOS** : The dropper uses AppleScript to download a C++ compiled Mach-O binary, saves it to /Library/Caches/com.apple.act.mond, makes it executable and launches it silently via /bin/zsh.
* **Windows** : The dropper searches for and copies the legitimate Windows PowerShell binary to %PROGRAMDATA%\\wt.exe. It then uses VBScript to fetch and execute a secondary PowerShell RAT script, which is subsequently executed by wt.exe. It also establishes persistence via a registry Run key.
* **Linux** : The dropper uses the Node.js execSync command to download a Python RAT script to /tmp/ld.py, running it in the background using the nohup command.

### Unified RAT Architecture

Despite being written in three different languages (C++, PowerShell and Python), all three payloads function as implementations of the same RAT framework.

They all use an identical C2 protocol, send Base64-encoded JSON data over an HTTP POST request and beacon to the server every 60 seconds. The C2 server accepts the same four commands from the attacker:

* kill (self-terminate)
* runscript (execute shell/script commands)
* peinject (drop and execute binary payloads)
* rundir (enumerate directories)

All the RAT variants use a hard-coded, highly anachronistic user-agent string spoofing Internet Explorer 8 on Windows XP: mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0.

### Overlap With WAVESHAPER

Initial analysis of the payload confirms significant [overlap](https://www.elastic.co/security-labs/axios-one-rat-to-rule-them-all) with [WAVESHAPER](https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering). WAVESHAPER is a C++ backdoor that communicates with its C2 server using the curl library, employing either HTTP or HTTPS as specified in the command-line arguments.

The C2 server's address is also provided via command-line parameters, allowing the backdoor to download and execute arbitrary payloads from the adversary's infrastructure.

WAVESHAPER also runs as a daemon by forking itself into a child process that runs in the background, detached from the parent session. It collects the returned system information, which is sent to the C2 server in an HTTP POST request.

### Forensic Cleanup

The entire process from installation to compromise takes roughly 15 seconds. Upon successfully launching the payload, the Node.js dropper performs aggressive anti-forensic cleanup. It deletes the setup.js file, removes the postinstall hook and replaces the tampered package.json with a clean decoy file named package.md. This ensures that developers inspecting their node\_modules folders after the installation will find no obvious signs of malicious code.

## Unit 42 Managed Threat Hunting Queries

The Unit 42 Managed Threat Hunting team continues to track any attempts to exploit this situation across our customers, using Cortex XDR and the XQL queries below. Cortex XDR customers can also use these XQL queries to search for signs of exploitation.  
// Title: Compromised Axios npm package version (1.14.1 and 0.30.4) C2 on Command Line // Description: First stage of activity once a compromised endpoint runs the affected axios package is for the dropper scripts to call out to their C2 domain sfrclak\[.\]com // MITRE ATT\&CK TTP ID: T1105 config case\_sensitive = false | dataset = xdr\_data | fields \_time, event\_type, event\_sub\_type, event\_id, agent\_hostname, agent\_id, action\_process\_image\_command\_line, actor\_process\_command\_line | filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START and action\_process\_image\_command\_line ~= "(?:\\bsfrclak\\.com\\b)" | comp values(action\_process\_image\_command\_line) as action\_process\_image\_command\_line, values(actor\_process\_command\_line) as actor\_process\_command\_line by \_time, agent\_hostname, agent\_id

|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | // Title: Compromised Axios npm package version (1.14.1 and 0.30.4) C2 on Command Line // Description: First stage of activity once a compromised endpoint runs the affected axios package is for the dropper scripts to call out to their C2 domain sfrclak\[.\]com // MITRE ATT\&CK TTP ID: T1105 config case\_sensitive = false | dataset = xdr\_data | fields \_time, event\_type, event\_sub\_type, event\_id, agent\_hostname, agent\_id, action\_process\_image\_command\_line, actor\_process\_command\_line | filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START and action\_process\_image\_command\_line ~= "(?:\\bsfrclak\\.com\\b)" | comp values(action\_process\_image\_command\_line) as action\_process\_image\_command\_line, values(actor\_process\_command\_line) as actor\_process\_command\_line by \_time, agent\_hostname, agent\_id |

// Title: Compromised Axios npm package version (1.14.1 and 0.30.4) Malicious plain-crypto-js package directory // Description: The malicious package is actually plain-crypto-js, this looks for directory creation events for that package name within a node\_modules folder // MITRE ATT\&CK TTP ID: T1204.005 config case\_sensitive = false | dataset = xdr\_data | fields \_time, event\_type, event\_sub\_type, event\_id, agent\_hostname, agent\_id, action\_file\_path, actor\_process\_command\_line | filter event\_type = ENUM.FILE and event\_sub\_type in (ENUM.FILE\_DIR\_CREATE, ENUM.FILE\_DIR\_WRITE, ENUM.FILE\_DIR\_RENAME) and lowercase(action\_file\_path) ~= "(?:\\bnode\_modules\[\\\\\\/\]plain-crypto-js\\b)" | comp values(action\_file\_path) as action\_file\_path, values(actor\_process\_command\_line) as actor\_process\_command\_line by \_time, agent\_hostname, agent\_id

|-------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | // Title: Compromised Axios npm package version (1.14.1 and 0.30.4) Malicious plain-crypto-js package directory // Description: The malicious package is actually plain-crypto-js, this looks for directory creation events for that package name within a node\_modules folder // MITRE ATT\&CK TTP ID: T1204.005 config case\_sensitive = false | dataset = xdr\_data | fields \_time, event\_type, event\_sub\_type, event\_id, agent\_hostname, agent\_id, action\_file\_path, actor\_process\_command\_line | filter event\_type = ENUM.FILE and event\_sub\_type in (ENUM.FILE\_DIR\_CREATE, ENUM.FILE\_DIR\_WRITE, ENUM.FILE\_DIR\_RENAME) and lowercase(action\_file\_path) ~= "(?:\\bnode\_modules\[\\\\\\/\]plain-crypto-js\\b)" | comp values(action\_file\_path) as action\_file\_path, values(actor\_process\_command\_line) as actor\_process\_command\_line by \_time, agent\_hostname, agent\_id |

// Title: Compromised Axios npm package version (1.14.1 and 0.30.4) File Indicators // Description: Upon installation of the compromised axios package via npm, the postinstall script deploys dropper scripts to download and install a remote access trojan on Mac, Linux, or Windows endpoints. // MITRE ATT\&CK TTP ID: T1105 \& T1219 config case\_sensitive = false | dataset = xdr\_data | fields \_time, event\_type, event\_sub\_type, event\_id, agent\_hostname, agent\_id, action\_file\_path, actor\_process\_command\_line | filter event\_type = ENUM.FILE and event\_sub\_type in (FILE\_CREATE\_NEW, FILE\_WRITE, FILE\_RENAME) and lowercase(action\_file\_path) ~= "(?:library\\/caches\\/com\\.apple\\.act\\.mond|\\/tmp\\/ld\\.py|c:\\\\programdata\\\\wt\\.exe|appdata\\\\local\\\\temp\\\\6202033\\.(?:ps1|vbs)|c:\\\\programdata\\\\system\\.bat)" | comp values(action\_file\_path) as action\_file\_path, values(actor\_process\_command\_line) as actor\_process\_command\_line by \_time, agent\_hostname, agent\_id

|-------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | // Title: Compromised Axios npm package version (1.14.1 and 0.30.4) File Indicators // Description: Upon installation of the compromised axios package via npm, the postinstall script deploys dropper scripts to download and install a remote access trojan on Mac, Linux, or Windows endpoints. // MITRE ATT\&CK TTP ID: T1105 \& T1219 config case\_sensitive = false | dataset = xdr\_data | fields \_time, event\_type, event\_sub\_type, event\_id, agent\_hostname, agent\_id, action\_file\_path, actor\_process\_command\_line | filter event\_type = ENUM.FILE and event\_sub\_type in (FILE\_CREATE\_NEW, FILE\_WRITE, FILE\_RENAME) and lowercase(action\_file\_path) ~= "(?:library\\/caches\\/com\\.apple\\.act\\.mond|\\/tmp\\/ld\\.py|c:\\\\programdata\\\\wt\\.exe|appdata\\\\local\\\\temp\\\\6202033\\.(?:ps1|vbs)|c:\\\\programdata\\\\system\\.bat)" | comp values(action\_file\_path) as action\_file\_path, values(actor\_process\_command\_line) as actor\_process\_command\_line by \_time, agent\_hostname, agent\_id |

// Title: Compromised Axios npm package version (1.14.1 and 0.30.4) C2 NGFW Traffic // Description: First stage of activity once a compromised endpoint runs the affected axios package is for the dropper scripts to call out to their C2 domain sfrclak\[.\]com // MITRE ATT\&CK TTP ID: T1105 config case\_sensitive = false | dataset = panw\_ngfw\_url\_raw | filter url\_domain ~= "(?:\\bsfrclak\\.com\\b)" | join type = left ( dataset = panw\_ngfw\_traffic\_raw | fields session\_id, source\_ip, dest\_ip, source\_port, dest\_port, action\_source, bytes\_received, bytes\_sent, bytes\_total, packets\_received, packets\_sent, packets\_total, chunks\_received, chunks\_sent, chunks\_total, session\_end\_reason ) as trafficraw trafficraw.session\_id = session\_id and trafficraw.source\_ip = source\_ip and trafficraw.dest\_ip = dest\_ip and trafficraw.source\_port = source\_port and trafficraw.dest\_port = dest\_port | fields \_time, \_reporting\_device\_name, action, action\_source, source\_ip, source\_port, source\_user, source\_location, dest\_ip, dest\_port, dest\_location, http\_method, http\_headers, uri, url\_category, url\_category\_list, url\_domain, app, app\_category, app\_sub\_category, bytes\_received, bytes\_sent, bytes\_total, packets\_received, packets\_sent, packets\_total, chunks\_received, chunks\_sent, chunks\_total, protocol, inbound\_if, outbound\_if, from\_zone, to\_zone, referer, referer\_fqdn, referer\_port, referer\_protocol, referer\_url\_path, rule\_matched, session\_id, session\_end\_reason, severity, sub\_type, technology\_of\_app, tunneled\_app, vsys | sort desc \_time

|-------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 | // Title: Compromised Axios npm package version (1.14.1 and 0.30.4) C2 NGFW Traffic // Description: First stage of activity once a compromised endpoint runs the affected axios package is for the dropper scripts to call out to their C2 domain sfrclak\[.\]com // MITRE ATT\&CK TTP ID: T1105 config case\_sensitive = false | dataset = panw\_ngfw\_url\_raw | filter url\_domain ~= "(?:\\bsfrclak\\.com\\b)" | join type = left ( dataset = panw\_ngfw\_traffic\_raw | fields session\_id, source\_ip, dest\_ip, source\_port, dest\_port, action\_source, bytes\_received, bytes\_sent, bytes\_total, packets\_received, packets\_sent, packets\_total, chunks\_received, chunks\_sent, chunks\_total, session\_end\_reason ) as trafficraw trafficraw.session\_id = session\_id and trafficraw.source\_ip = source\_ip and trafficraw.dest\_ip = dest\_ip and trafficraw.source\_port = source\_port and trafficraw.dest\_port = dest\_port | fields \_time, \_reporting\_device\_name, action, action\_source, source\_ip, source\_port, source\_user, source\_location, dest\_ip, dest\_port, dest\_location, http\_method, http\_headers, uri, url\_category, url\_category\_list, url\_domain, app, app\_category, app\_sub\_category, bytes\_received, bytes\_sent, bytes\_total, packets\_received, packets\_sent, packets\_total, chunks\_received, chunks\_sent, chunks\_total, protocol, inbound\_if, outbound\_if, from\_zone, to\_zone, referer, referer\_fqdn, referer\_port, referer\_protocol, referer\_url\_path, rule\_matched, session\_id, session\_end\_reason, severity, sub\_type, technology\_of\_app, tunneled\_app, vsys | sort desc \_time |

## Conclusion

Attackers have been increasing the frequency and scale of npm supply chain operations since early 2026. Securing the continuous integration/continuous deployment (CI/CD) pipeline should be a high priority for any organization to mitigate against this growing threat.

Based on the amount of publicly available information, we highly recommend the following actions:

### Immediate Assessment and Isolation

* **Audit for malicious packages** : Search your projects and node\_modules directories for the compromised Axios versions (1.14.1 and 0.30.4) and the injected plain-crypto-js package (versions 4.2.0 and 4.2.1).
* **Check for malware artifacts** : Inspect systems for platform-specific indicators of compromise, such as /Library/Caches/com.apple.act.mond (macOS), %PROGRAMDATA%\\wt.exe (Windows) and /tmp/ld.py (Linux).
* **Isolate affected systems**: If you discover the malicious packages or RAT artifacts, immediately isolate the system from the network.

### Remediation and Rebuilding

* **Rebuild from scratch**: If an environment is compromised, do not attempt to clean the malware while it is still in place. Instead, completely rebuild the environment from a known-good state.
* **Clear caches**: Clear your local and shared package manager caches (npm, yarn, pnpm) on all workstations and build servers to prevent reinfection during future installs.

### Comprehensive Credential Rotation

* **Assume compromise**: If the malicious package was executed, you must assume all secrets accessible on that machine have been stolen.
* **Rotate all secrets** : Immediately rotate exposed credentials, including npm tokens, AWS access keys, SSH private keys, cloud environment credentials (Google Cloud, Azure), CI/CD secrets and any sensitive values stored in .env files.

### Version Control and Dependency Pinning

* **Downgrade Axios**: Immediately downgrade to the last known safe versions of Axios: 1.14.0 or 0.30.3.
* **Pin dependencies** : Pin Axios to these safe versions within your package-lock.json file to prevent accidental upgrades.
* **Use overrides**: Add an overrides block in your package configuration to prevent malicious versions from being resolved transitively by other packages.
* **Restrict corporate repositories**: Configure corporate-managed npm repositories to strictly serve only the known-good versions of Axios.

### Network Defense and Monitoring

* **Block C2 traffic** : Block all egress traffic to the attacker's C2 domain (sfrclak\[.\]com) and IP address (142.11.206\[.\]73).
* **Monitor logs**: Monitor network logs for suspicious outbound connections over port 8000, beaconing behavior and anomalous HTTP POST requests.

### CI/CD and Pipeline Hardening

* **Audit CI/CD pipelines**: Review automated build logs to see if the affected versions were installed during recent runs. Rotate any secrets for workflows that executed them.
* **Pause and validate deployments**: Temporarily pause CI/CD deployments for projects relying on Axios, to validate that your builds are not automatically pulling the poisoned "latest" versions.
* **Disable lifecycle scripts** : Use the --ignore-scripts flag during CI/CD installations to explicitly prevent npm postinstall hooks from running during automated builds.

### Long-Term Developer Security

* **Sandbox environments**: Isolate development environments using containers or sandboxes to restrict host file system access.
* **Vault secrets** : Migrate plaintext secrets away from developer machines and into secure vaults or OS keychains (using tools like aws-vault) so that malicious scripts cannot programmatically scrape them.
* **Deploy endpoint detection and response (EDR)**: Ensure EDR solutions are deployed on developer workstations to monitor for suspicious processes spawning from Node.js applications.

Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org/).

Palo Alto Networks customers are better protected by our products, as listed below. We will update this threat brief as more relevant information becomes available.

## Palo Alto Networks Product Protections for the Axios Supply Chain Attack

Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat.

If you think you might have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:

* North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
* UK: +44.20.3743.3660
* Europe and Middle East: +31.20.299.3130
* Asia: +65.6983.8730
* Japan: +81.50.1790.0200
* Australia: +61.2.4062.7950
* India: 000 800 050 45107
* South Korea: +82.080.467.8774

### Advanced WildFire

The [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of indicators shared in this research.

### Next-Generation Firewalls With Advanced Threat Prevention

[Next-Generation Firewall](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/url-filtering-features/advanced-url-filtering) with the [Advanced Threat Prevention](https://docs.paloaltonetworks.com/dns-security) security subscription can help block the attack via the following Threat Prevention signature: [87121](https://threatvault.paloaltonetworks.com/?q=87121).

### Cloud-Delivered Security Services for the Next-Generation Firewall

[Advanced URL Filtering](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/url-filtering-features/advanced-url-filtering) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known IP addresses and domains associated with this activity as malicious.

### Cortex AgentiX

Security analysts can use natural language to prompt the [Cortex AgentiX](https://www.paloaltonetworks.com/cortex/agentix) Threat Intel agent to extract file indicators of compromise (IoCs) from this threat brief. They will then need to enrich them, check for sightings in their Cortex tenant and related alerts, and provide a quick summary of the impact to the organization.

### Cortex XDR and XSIAM

[Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) provide a multi-layer defense to help protect against the initial access, C2 and potential lateral movement described in this article. This includes Behavioral Threat Protection (BTP), Advanced WildFire and Cortex Analytics.

Specifically, we have observed out-of-the-box (OotB) prevention via Advanced WildFire and BTP for the second stages of this attack on Windows and macOS. Cortex Analytics can help detect C2 activity and suspicious supply chain activity using our tailored detectors described in the following articles:

* [How Behavioral Analytics Stop Linux C2 \& Credential Theft - Palo Alto Networks Blog](https://www.paloaltonetworks.com/blog/security-operations/how-behavioral-analytics-stop-linux-c2-credential-theft/)
* [How Cortex XDR Global Analytics Protects Against Supply Chain Attacks - Palo Alto Networks Blog](https://www.paloaltonetworks.com/blog/security-operations/how-cortex-xdr-global-analytics-protects-against-supply-chain-attacks/)

We advise customers to upgrade agents to supported versions and the latest content update to receive the best protection.

### Cortex Cloud

The [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) platform provides detection and prevention operations for both the first and second stages of the Axios attack chain. This includes Software Supply Chain Security, Application Security (AppSec), Cloud Workload Protection (CWP), Cortex XDR and XSIAM.

Every phase of the attack can be mapped to a Cortex Cloud capability that either helps prevent or detects it, from CI/CD trusted publisher verification operations to runtime post-installation monitoring and endpoint persistence detection.

## Indicators of Compromise

### SHA256 Hashes

* ad8ba560ae5c4af4758bc68cc6dcf43bae0e0bbf9da680a8dc60a9ef78e22ff7
* fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf
* cdc05cd30eb53315dadb081a7b942bb876f0d252d20e8ed4d2f36be79ee691fa
* 8449341ddc3f7fcc2547639e21e704400ca6a8a6841ae74e57c04445b1276a10
* 01c9484abc948daa525516464785009d1e7a63ffd6012b9e85b56477acc3e624
* 7b47ed28e84437aee64ffe9770d315c1b984135105f7f608a8b9579517bc0695
* 526ab39d1f56732e4e926715aaa797feb13b1ae86882ec570a4d292e7fdc3699
* a98e04dec3a7fe507eb30c72da808bad60bc14d9d80f9770ec99c438faa85a1a
* 0d83030ab8bfba675fc1661f0756b6770be7dd80b1b718de3d68a01f2e79a5f4
* 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a
* 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668
* fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf
* e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
* f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd
* 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101
* e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff
* 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a
* 506690fcbd10fbe6f2b85b49a1fffa9d984c376c25ef6b73f764f670e932cab4
* 4465bdeaddc8c049a67a3d5ec105b2f07dae72fa080166e51b8f487516eb8d07
* fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf
* 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668
* 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd
* 59336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0f
* a224dd73b7ed33e0bf6a2ea340c8f8859dfa9ec5736afa8baea6225bf066b248
* 5e2ab672c3f98f21925bd26d9a9bba036b67d84fde0dfdbe2cf9b85b170cab71
* 20df0909a3a0ef26d74ae139763a380e49f77207aa1108d4640d8b6f14cab8ca
* 5b5fbc627502c5797d97b206b6dcf537889e6bea6d4e81a835e103e311690e22
* 506690fcbd10fbe6f2b85b49a1fffa9d984c376c25ef6b73f764f670e932cab4
* 4465bdeaddc8c049a67a3d5ec105b2f07dae72fa080166e51b8f487516eb8d07
* 9c64f1c7eba080b4e5ff17369ddcd00b9fe2d47dacdc61444b4cbfebb23a166c

### IP Addresses and Domains

* 142\.11.206\[.\]73
* sfrclak\[.\]com
* callnrwise\[.\]com
* hxxp://sfrclak\[.\]com:8000
* hxxp://sfrclak\[.\]com:8000/6202033

*Updated April 1, 2026, at 1:15 p.m. PT to add coverage for Advanced WildFire.*

*Updated April 9, 2026, at 8:50 a.m. PT to add coverage for Advanced Threat Prevention.*

*Updated April 13, 2026, at 12:50 p.m. PT to clarify how the RAT is executed in its Windows version. Added coverage for Cortex AgentiX.*
Back to top

### Tags

* [API attacks](https://unit42.paloaltonetworks.com/tag/api-attacks/ "API attacks")
* [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript")
* [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell")
* [Supply chain](https://unit42.paloaltonetworks.com/tag/supply-chain/ "supply chain")
* [Trojan](https://unit42.paloaltonetworks.com/tag/trojan/ "Trojan")
* [VBScript](https://unit42.paloaltonetworks.com/tag/vbscript/ "VBScript")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure](https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/ "Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure")

### Table of Contents

* 

### Related Articles

* [Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "article - table of contents")
* [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain](https://unit42.paloaltonetworks.com/sdlc-supply-chain/ "article - table of contents")
* [Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of autonomous AI use. A digital abstract image depicting a network of colorful, intertwining lines and nodes on a blue background, conveying themes of connectivity and technology.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/11/AdobeStock_992950050-5-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 12, 2026 [#### Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors](https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [DeepSeek](https://unit42.paloaltonetworks.com/tag/deepseek/ "DeepSeek")

* [Exploits](https://unit42.paloaltonetworks.com/tag/exploits/ "exploits")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/ "Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors")  
  ![Pictorial representation of Falcon C2 browser threat. A blurred image focusing on a person typing on a laptop with lines of code visible on the screen, illuminated in blue and red lights, suggestive of intense coding or cyber activities.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/11/06_Malware_Category_1920x900-8-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 11, 2026 [#### The XG Files: Falcon C2 Flying Under The (Browser) Radar](https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/)

* [Adobe Flash Player](https://unit42.paloaltonetworks.com/tag/adobe-flash-player/ "Adobe Flash Player")

* [Browser extension](https://unit42.paloaltonetworks.com/tag/browser-extension/ "browser extension")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/ "The XG Files: Falcon C2 Flying Under The (Browser) Radar")  
  ![Pictorial representation of TLS Certificate compromise. A person typing on a laptop with digital graphics of binary code and light beams emanating from the screen, representing data transfer or cyber activity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/07_Security-Technology_Category_1920x900-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) October 22, 2026 [#### EMudhra Intermediate CA Certificates Compromised](https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/)

* [Certificates](https://unit42.paloaltonetworks.com/tag/certificates/ "certificates")

* [Compromise](https://unit42.paloaltonetworks.com/tag/compromise/ "Compromise")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/ "EMudhra Intermediate CA Certificates Compromised")  
  ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_1246251272-2-1-786x369.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 21, 2026 [#### "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities](https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration")

* [DeepSeek](https://unit42.paloaltonetworks.com/tag/deepseek/ "DeepSeek")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/ "“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities")  
  ![Pictorial representation of AI-powered campaign targeting government infrastructure. A glowing, blue, brain-shaped structure floats above a central microchip on a circuit board. The scene is futuristic, with neon lights illuminating the interconnected pathways and components.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_637057734-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 15, 2026 [#### AI-Powered Espionage Campaign Targets Government Linux Infrastructure](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/)

* [Exfiltration](https://unit42.paloaltonetworks.com/tag/exfiltration/ "exfiltration")

* [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM")

* [Network security](https://unit42.paloaltonetworks.com/tag/network-security/ "network security")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ "AI-Powered Espionage Campaign Targets Government Linux Infrastructure")  
  ![Pictorial representation of PEERSTITCH, a FortiGate implant. A digital illustration depicting a circuit board with a prominent red warning triangle and exclamation mark in the center. The background is filled with various computer circuitry patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/09_Vulnerabilities_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 14, 2026 [#### Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)

* [Apache](https://unit42.paloaltonetworks.com/tag/apache/ "Apache")

* [CL-STA-0954](https://unit42.paloaltonetworks.com/tag/cl-sta-0954/ "CL-STA-0954")

* [Logging](https://unit42.paloaltonetworks.com/tag/logging/ "logging")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant")  
  ![Pictorial representation of operation blinder tunnel. Screen displaying code with a prominent alert symbol and the words 'VIRUS DETECTED' highlighted in red.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/05_Malware_Category_1920x900-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 6, 2026 [#### Blinder Tunnel Campaign Targets Iraqi Infrastructure](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/)

* [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat")

* [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens")

* [AppDomainManager](https://unit42.paloaltonetworks.com/tag/appdomainmanager/ "AppDomainManager")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/ "Blinder Tunnel Campaign Targets Iraqi Infrastructure")  
  ![Pictorial representation of how K8 operators betray your security posture. A close-up of a futuristic microchip with glowing circuits in vibrant colors, including blue, purple, and orange, reflecting light.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_652069707-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 29, 2026 [#### OperTraitors: How Kubernetes Operators Betray Your Security Posture](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [AI agents](https://unit42.paloaltonetworks.com/tag/ai-agents/ "AI agents")

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/ "OperTraitors: How Kubernetes Operators Betray Your Security Posture")  
  ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/)

* [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS")

* [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence")

* [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity")  
  ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* Observability

* [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center-subscribe.html)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)