[](https://www.paloaltonetworks.com/)
[](https://unit42.paloaltonetworks.com/)
Menu
* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)
English
* [English](https://unit42.paloaltonetworks.com/caught-in-the-act-from-intrusive-coin-miners-to-scam-websites/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/caught-in-the-act-from-intrusive-coin-miners-to-scam-websites/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Trend Reports](https://unit42.paloaltonetworks.com/category/trend-reports/ "Trend Reports")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")
[Malware](https://unit42.paloaltonetworks.com/category/malware/)
# Caught in the Act: From Intrusive Coin Miners to Scam Websites
 11 min read
Related Products
[Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")
* 
By:
* [Oleksii Starov](https://unit42.paloaltonetworks.com/author/oleksii-starov/)
* [Yuchen Zhou](https://unit42.paloaltonetworks.com/author/yuchen-zhou/)
* 
Published:January 16, 2019
* 
Categories:
* [Malware](https://unit42.paloaltonetworks.com/category/malware/)
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)
* [Trend Reports](https://unit42.paloaltonetworks.com/category/trend-reports/)
* 
Tags:
* [Coinhive](https://unit42.paloaltonetworks.com/tag/coinhive/)
* [CoinImp](https://unit42.paloaltonetworks.com/tag/coinimp/)
* [Crypto-Loot](https://unit42.paloaltonetworks.com/tag/crypto-loot/)
* [Cryptocurrency mining](https://unit42.paloaltonetworks.com/tag/cryptocurrency-mining/)
* [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/)
* [JSE-Coin](https://unit42.paloaltonetworks.com/tag/jse-coin/)
* [](https://unit42.paloaltonetworks.com/caught-in-the-act-from-intrusive-coin-miners-to-scam-websites/?pdf=download&lg=en&_wpnonce=0f3101da20 "Click here to download")
* [](https://unit42.paloaltonetworks.com/caught-in-the-act-from-intrusive-coin-miners-to-scam-websites/?pdf=print&lg=en&_wpnonce=0f3101da20 "Click here to print")
Share
* 
* [](mailto:?subject=Caught%20in%20the%20Act:%20From%20Intrusive%20Coin%20Miners%20to%20Scam%20Websites&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fcaught-in-the-act-from-intrusive-coin-miners-to-scam-websites%2F "Share in email")
* [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcaught-in-the-act-from-intrusive-coin-miners-to-scam-websites%2F "Share in Facebook")
* [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcaught-in-the-act-from-intrusive-coin-miners-to-scam-websites%2F&title=Caught%20in%20the%20Act:%20From%20Intrusive%20Coin%20Miners%20to%20Scam%20Websites "Share in LinkedIn")
* [](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcaught-in-the-act-from-intrusive-coin-miners-to-scam-websites%2F&text=Caught%20in%20the%20Act:%20From%20Intrusive%20Coin%20Miners%20to%20Scam%20Websites "Share in Twitter")
* [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcaught-in-the-act-from-intrusive-coin-miners-to-scam-websites%2F&ts=markdown "Share in Reddit")
* [](https://mastodon.social/share?text=Caught%20in%20the%20Act:%20From%20Intrusive%20Coin%20Miners%20to%20Scam%20Websites%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fcaught-in-the-act-from-intrusive-coin-miners-to-scam-websites%2F "Share in Mastodon")
At Palo Alto Networks, we use various methods to detect malicious web pages and malicious JavaScript on websites our customers visit online. In addition to static approaches such as signature matching, our security crawlers execute all scripts discovered on web pages and observe their dynamic behavior. Then, we apply special behavioral signatures based on different indicators, such as global variables declared during runtime, popup messages shown to the user, established WebSocket connections, and others. Using such signatures we are able to detect malicious campaigns even in obfuscated, packed, or randomized JavaScript, as final malicious behavior remains the same. In particular, this method proved efficient in discovering such modern threats as intrusive coin miners (previously described [here](https://www.paloaltonetworks.com/resources/blogs/unit42-unauthorized-coin-mining-browser.html)) and numerous kinds of scam campaigns.
In November 2018, we detected 8,712 distinct URLs with intrusive coin miners, which our customers attempted to visit more than one million times from more than 30,000 devices. In addition to the most popular, Coinhive, only a few other libraries are noticeably present, such as JSE-Coin, Crypto-Loot, and CoinImp. Unlike dedicated malicious websites that serve no other legitimate purposes, coin mining scripts are sometimes injected voluntarily into popular video streaming sites, therefore their domains are significantly more long living and popular than sites hosting other types of malicious JavaScripts. However, with behavioral analysis we can separate unauthorized coin mining (which starts without user consent), and thus detect and denylist really intrusive cases.
In addition, we captured 4,633 additional distinct URLs that lead to scams, clickjacking, phishing, and other malicious JavaScripts that were frequently targeting our customers from around the globe. Two of the most observed scam campaigns were technical support scam and fake Flash update pages.
Trends in Malicious JavaScript
From October 19, 2018 to November 19, 2018, we applied behavioral analysis to URLs coming from Palo Alto Networks customers that were unknown to our URL filtering categories on a daily basis. We then crawled Alexa's top one million URLs as well as a feed of recently registered domains. Overall, we detected 9,104 coin mining scripts (over 8,712 distinct URLs), and 4,788 other malicious JavaScripts (over 4,633 distinct URLs), which were undetectable using static analysis.
Results for Coin Miners
On average, we were detecting 1,097 coin mining URLs per day, including 184 previously unseen malicious URLs. Figure 1 shows the daily detection rates in detail (note, this is not a cumulative plot as it shows independent results per each day). Despite minor periodic drops in number, the overall trend of newer detections remains stable over time. Also, we keep detecting the same coin miners from day to day, highlighting the fact that coin mining websites are longer living compared to other more indisputable kinds of malicious JavaScript, such as phishing or exploits.
*Figure 1. Daily detection rate of coin mining URLs*
Figure 2 illustrates the distribution of popular families of coin miners among 9,104 scripts detected during the mentioned month. As we can see, Coinhive is leading with 46.8%, followed by 12.6% of anonymous Stratum Protocol communications. While other coin mining libraries trail behind; such as JSE-Coin (10.9%), Crypto-Loot (10%), CoinImp (6.7%), Monerise (6.6%), and NeroHut (1.4%). Interestingly, more than ten other coin mining libraries, including CoinNebula, BatMine, DeepMiner, CryptoNoter, Minr and others, collectively contribute to only 5% of all the detected scripts. This is possibly an indication of a change in coin mining trends, as we were detecting more of those libraries previously. Moreover, during past month we did not observe several libraries that were detected up to three months ago, namely WebXMR, ProjectPoi, and Grindcash.
*Figure 2. Top recently observed coin miners*
6,026 out of the 8,712 URLs with coin miners, or 69.1%, perform "unauthorized" coin mining. In other words, they start mining immediately after visiting the page, without asking users for consent. The most popular choice among coin mining libraries to perform unauthorized mining were CoinImp (unauthorized in 100% cases over 612 scripts), Crypto-Loot (in 86% cases over 906 scripts), Coinhive (in 77.7% cases over 3,312 scripts), and other 1,143 scripts generating unidentified stratum traffic.
At the same time, we observe many coin mining campaigns deploy additional techniques to remain stealthy. These include tactics such as static obfuscation and packing of their code. For example, we encountered many variations of mining JavaScript libraries similar to the one below, served from custom servers and usually named unrecognizably or even pretending to be popular benign scripts, such as "jquery.min.js".
(function(){ var \_0xdf51=\["\\x70\\x61\\x72\\x61\\x6D\\x73","\\x5F\\x73\\x69\\x74\\x65\\x4B\\x65\\x79","\\x5F\\x75\\x73\\x65\\x72","\\x5F\\x74\\x68\\x72\\x65\\x61\\x64\\x73","\\x5F\\x68\\x61\\x73\\x68\\x65\\x73","\\x5F\\x63\\x75\\x72\\x72\\x65\\x6E\\x74\\x4A\\x6F\\x62","\\x5F\\x61\\x75\\x74\\x6F\\x52\\x65\\x63\\x6F\\x6E\\x6E\\x65\\x63\\x74", ... MINER\_URL:\_0xdf51\[207\],AUTH\_URL:\_0xdf51\[208\]};CoinHive\[\_0xdf51\[104\]\]= CoinHive.Res(\_0xdf51\[209\]);var user=window\[\_0xdf51\[211\]\]\[\_0xdf51\[210\]\]|| \_0xdf51\[212\],miner= new CoinHive.User(\_0xdf51\[213\],user,{throttle:0.3});miner\[\_0xdf51\[89\]\]()|| miner\[\_0xdf51\[53\]\]() })();
|-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 | (function(){ var \_0xdf51=\["\\x70\\x61\\x72\\x61\\x6D\\x73","\\x5F\\x73\\x69\\x74\\x65\\x4B\\x65\\x79","\\x5F\\x75\\x73\\x65\\x72","\\x5F\\x74\\x68\\x72\\x65\\x61\\x64\\x73","\\x5F\\x68\\x61\\x73\\x68\\x65\\x73","\\x5F\\x63\\x75\\x72\\x72\\x65\\x6E\\x74\\x4A\\x6F\\x62","\\x5F\\x61\\x75\\x74\\x6F\\x52\\x65\\x63\\x6F\\x6E\\x6E\\x65\\x63\\x74", ... MINER\_URL:\_0xdf51\[207\],AUTH\_URL:\_0xdf51\[208\]};CoinHive\[\_0xdf51\[104\]\]= CoinHive.Res(\_0xdf51\[209\]);var user=window\[\_0xdf51\[211\]\]\[\_0xdf51\[210\]\]|| \_0xdf51\[212\],miner= new CoinHive.User(\_0xdf51\[213\],user,{throttle:0.3});miner\[\_0xdf51\[89\]\]()|| miner\[\_0xdf51\[53\]\]() })(); |
In such cases, matching of static signatures and file hashes can be challenging as they are almost always unique, but when we execute these scripts, it is straightforward to detect the same known global variables created on the page, namely "CoinHive" and "miner". Moreover, the process of coin mining can also be detected by analyzing the WebSocket traffic.
As a result, at least 1,414 out of 4,264 Coinhive scripts, or 33.2%, were detected only because we were using dynamic analysis with behavioral signatures. Other methods, such as hash matching of the abstract syntax tree, could not bypass the obfuscation.
It is worth mentioning that we detected many cases when the same web page rotates coin miners from visit to visit or hosts several different coin mining libraries at the same time. For examples, such pairs as Coinhive and JSE-Coin, or Crypto-Loot and NeroHut are common. Figure 3 illustrates a screenshot for one of such case, when both libraries start to mine immediately after visiting the page. Due to these occurrences, the overall number of detected mining scripts for one month (9,104) was greater than the overall number of unique URLs (8,712).
*Figure 3. Example of a website with two active coin miners*
Results for Scam JavaScript
As for other malicious JavaScripts (excluding coin miners), we were able to detect around 184 additional URLs per day, and around 143 new URLs. Figure 4 shows the daily detection rates. As shown, rates for the overall detected URLs and newly discovered URLs are much closer to each other than on Figure 1 for coin miners. This means that URLs hosting scam-related JavaScript are shorter lived and are less likely to be observed for many days in a row.
*Figure 4. Daily detection rate of scam URLs*
Outside of coin miner JavaScript attacks, we also discovered 4,788 non-mining malicious samples with the distribution seen in Figure 6. As we mentioned earlier, technical support scams and fake Flash update scams were the most popular malicious campaigns of November 2018 (examples of such malicious pages are shown on Figure 5). At the same time, other types of malicious scam campaigns include phishing kits, clickjacking kits, fake reward and other kinds of modern scams.
*Figure 5. Screenshots of the most popular scam pages in November 2018*
*Figure 6. Top recently observed on-mining malicious JavaScripts*
Particularly interesting is the case of technical support scam pages, which trick users into calling and paying scammers or installing unwanted programs. Analyzing these pages revealed evidence indicating they may all be associated with a single actor group. First, of the 1,989 found URLs that lead to technical support scams, at least 1,668 resulted in the same page with the same screenshot, such as the one shown on the left of Figure 6. These pages were showing JavaScript popups with the same alarming text:
"Warning!\\n\\nMicrosoft Windows system has detected that your Windows 7 7 is currently outdated and corrupted.\\n\\nThis will automatically erase your system files.\\n\\nPlease follow the instructions immediately to resolve this issue and ensure that your system is always up to date."
|---|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 | "Warning!\\n\\nMicrosoft Windows system has detected that your Windows 7 7 is currently outdated and corrupted.\\n\\nThis will automatically erase your system files.\\n\\nPlease follow the instructions immediately to resolve this issue and ensure that your system is always up to date." |
Second, many recent landing pages of these URLs were hosted on domains that followed the same pattern according to the regex below (for example, "gaf9342\[.\]space" and "gba9462\[.\]site").
g\[a-z\]{2}\[0-9\]{4}.(online|space|site|website|host)
|---|------------------------------------------------------------|
| 1 | g\[a-z\]{2}\[0-9\]{4}.(online|space|site|website|host) |
In comparison, the Fake flash update pages were more adaptive to the victim, showing different pages in cases of Google Chrome vs. Internet Explorer, and MS Windows vs. Mac OS. In addition, fake Flash campaigns update their popup texts more frequently. For example, below is the most common text in fake Flash on-page alerts:
"WARNING! Your official Adobe \Flash Player\ version is out of date. Please install latest software update to continue. Please click \\"Update\\" to continue."
|---|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 | "WARNING! Your official Adobe \Flash Player\ version is out of date. Please install latest software update to continue. Please click \\"Update\\" to continue." |
It is important to emphasize that exact text matches of such alerts would result in a limited number of detections, instead we train our models based on the most significant terms associated with scams. Therefore, we are prepared for different text randomization and obfuscation tricks that attackers may apply, such as double spaces between key words as with "Flash Player" above, injection of new lines, and messages in other languages.
Other types of malicious JavaScript, such as redirectors/injectors, droppers, and exploits were not as widely detected by behavior-based approaches in November (less than 1% according to Figure 6). Such threats includes simpler scripts such as redirectors, which usually just drop an iframe on the page, do not usually use global variables. Palo Alto Networks implements other techniques to detect such malicious scripts. For example, we analyze all sub-requests originating from the page during crawling, including requests from injected malicious iframes and scripts. As for exploit kits -- we inspect OS-level behavior of the exploit kits within a high-interaction Windows/IE environment.
Malicious Domain Analysis
Overall, we discovered 8,712 coin mining URLs which resolve to 7,654 distinct domains. In addition to coin mining, we detected 4,633 URLs with other malicious scripts which resolve to 2,666 domains. We looked up both sets of domains in our passive DNS (pDNS) database, which gave us the ability to estimate both their life span and popularity. Figure 7 is a scatter plot showing how many days each domain was active and how many times it was resolved (or in other words, how popular is the domain).
*Figure 7. Life span vs. popularity of malicious URLs*
Based on Figure 7 we can infer that coin mining domains are significantly more popular and longer-living, whereas other malicious domains usually live less than 100 days and receive less than 10,000 DNS resolutions (lower cluster of blue dots). This is not surprising as scam and phishing campaigns eventually get discovered and blocked, and thus have to rotate their domains. Contrastingly, coin miners usually fall into a grey zone, being malicious enough that users want to block the mining, while not always being enough reason to permanently block a domain or shutdown a server. Even many reputable websites deliberately incorporate coin miners, forcing their visitors to agree with that in exchange for 'free' content access.
As we see on Figure 7, some domains are extremely prevalent, receiving more than tens of millions DNS resolutions and living for more than 4 years. These examples include domains directly related to mining (such as, "coinhive\[.\]com" and "moonbit\[.\]co\[.\]in"), as well as various websites with high-demand content (such as, "xxgasm\[.\]com", "seriesfree\[.\]to", "rumorfix\[.\]com", and "gooddrama\[.\]net"). Interestingly, on the scatter plot we also see domains with many DNS requests, but with a shorter life cycle. We suspect that those are cases when an illegitimate website is registered and becomes very popular. For example, "indoxxi\[.\]cool" offering online movies lived for only 14 days, but already has 63,694 resolutions in pDNS records.
Examples of non-mining malicious JavaScripts are usually hosted on specially-crafted domains, such as, "win32-0x2ndt-firewall-error\[.\]gq" (technical support scam), "www2\[.\]betterdealupgradeaflash\[.\]icu" (fake Flash update), or "paypal-verificationupdate\[.\]obay\[.\]me" (phishing). Or in general, on less popular websites. One may notice that on Figure 7 there are also rare cases of highly popular and long-living scam domains. For example, these are domains of URL shorteners (e.g., "ow\[.\]ly" and "smarturl\[.\]it"), domains serving ads and frequently used by scam campaigns (e.g., "blank\[.\]com" and "elitedollars\[.\]com"). Similarly, popular but illegitimate websites (e.g., "mytorrents\[.\]org" and "yourmovie\[.\]org") also exist over longer period of time.
After analyzing Alexa rankings for TLD+1 domains (e.g. xyz.com instead of abc.xyz.com) of the detected coin mining domains, we were surprised to find that the majority of them, namely 66.9%, were in Alexa's top million at least for one day during that month. Moreover, 1,295 coin mining domains remained in the top million, including 37 domains in the first 10,000. On one hand, these results suggest that when reputable websites begin to adopt mining, they are likely to drop out from the top popular websites. On the other hand, we are still alarmed by the high number of unauthorized coin miners among the Alexa's top million websites. Figure 8 shows the distribution of 1,295 coin mining domains we detected across Alexa's rank ranges, and we clearly see that unauthorized miners dominate even in the top 100,000.
In contrast, only 71 from non-mining malicious JavaScript domains were found in Alexa's top million, including 7 in the top 10,000. One of the most popular examples for both mining and non-mining categories of malicious JavaScripts were websites hosted on "blogspot\[.\]com", since each subdomain consists of a completely different website.
*Figure 8. Rank distribution of coin mining domains in Alexa's Top Million*
Table 1 lists the most popular TLDs, which serve coin miners and other malicious scripts. As we see, the \[.\]icu TLD was abused the most in November to distribute different kinds of scams. Regarding coin mining domains, most of them reside on the more reputable \[.\]com TLD, which matches our previous finding that miners are often times present on more popular and long living websites (such as blogs, video downloads, and torrents).
|---------|--------------|---------|--------------|
| **Coin miners** || **Malicious JS** ||
| **TLD** | **# Domain** | **TLD** | **# Domain** |
| com | 3487 | icu | 1299 |
| ir | 394 | com | 409 |
| net | 337 | club | 290 |
| ru | 319 | xyz | 83 |
| org | 285 | tk | 61 |
| br | 206 | cf | 49 |
| tk | 111 | net | 32 |
| info | 108 | ga | 27 |
| de | 91 | ml | 23 |
| in | 91 | online | 22 |
*Table 1. Top 10 TLDs Serving coin miners and malicious JavaScript*
In order to understand the geography of malicious websites, we translated their IP addresses into locations. Figure 8 shows the country-level distribution of the IPs for coin miners, while Figure 9 illustrates the map for other malicious JavaScript. One may notice that coin mining websites cover more countries, though both maps show the majority of servers are located in US.
*Figure 8. Country-level distribution of coin mining IPs*
*Figure 9. Country-level distribution of IPs serving non-mining Malicious JS*
Customer Impact
During one month, our customers attempted to visit 6,804 coin mining URLs out of the 8,712 described above. Overall, we registered more than 1.1 million requests towards these websites from more than 30,000 devices. Similarly, our telemetry data reveals that 4,476 scam URLs (out of 4,633) were requested by our customers more than 243,000 times from 12,000 unique devices around the globe.
Such extensive impact on real web users puts malicious JavaScript campaigns as one of the most common threats on the modern web. Therefore, light-weight dynamic methods to detect obfuscated malicious code, which can be run on a large scale, are extremely important for proactive protection.
Conclusion
Behavioral analysis of JavaScript is important ammunition against modern threats, such as unauthorized coin miners and numerous scam campaigns. Such behavioral signatures as global variable, alert texts, and WebSocket messages, while helpful, are not the only dynamic information that helps in detecting malicious scripts. At Palo Alto Networks, we set ourselves to continue improving the detection methods of online threats and protecting our customers.
Intrusive coin miners continue to be one of the main threats on the Web, but only a few mining libraries are trending based on the past month. In addition to the most well-known Coinhive library, only JSE-Coin, Crypto-Loot and CoinImp are noticeably present. Coin mining domains are significantly longer living and more popular in comparison to scam campaigns, which makes accurately blocking them crucial for our customers' protection. With behavioral analysis we can separate unauthorized coin mining, and detect not only the inclusion of mining libraries but also the mining process by itself.
Technical support scams and fake Flash update scams are the next most prevalent types of malicious JavaScript after coin miners. It is very important to discover and block these websites before any user visits them.
As of now, we continue to scan the web on a daily basis, enriching our database of malicious websites. As a result, Palo Alto Networks customers are protected from websites hosting malicious JavaScripts via PAN-DB URL Filtering and DNS signatures as part of the Threat Prevention subscription.
Indicators of Compromise
In the files below, we list all the URLs that lead to coin miners and scam JavaScript, which were released to PANDB based on the results described above (note, some of those URLs are malicious gateways that may lead to different landing pages).
[coin\_mining\_urls](https://github.com/pan-unit42/iocs/blob/master/6908_of_8712_coin_mining_urls_in_pandb.txt)
[scam\_js\_urls](https://github.com/pan-unit42/iocs/blob/master/4457_of_4633_scam_js_urls_in_pandb.txt)
Back to top
### Tags
* [Coinhive](https://unit42.paloaltonetworks.com/tag/coinhive/ "Coinhive")
* [CoinImp](https://unit42.paloaltonetworks.com/tag/coinimp/ "CoinImp")
* [Crypto-Loot](https://unit42.paloaltonetworks.com/tag/crypto-loot/ "Crypto-Loot")
* [Cryptocurrency mining](https://unit42.paloaltonetworks.com/tag/cryptocurrency-mining/ "Cryptocurrency mining")
* [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript")
* [JSE-Coin](https://unit42.paloaltonetworks.com/tag/jse-coin/ "JSE-Coin")
[Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Web-based Threats-2018 Q3: Malicious URLs and Domains take a Dip](https://unit42.paloaltonetworks.com/web-based-threats-2018-q3-malicious-urls-and-domains-take-a-dip/ "Web-based Threats-2018 Q3: Malicious URLs and Domains take a Dip")
### Related Articles
* [Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "article - table of contents")
* [Threat Brief: Widespread Impact of the Axios Supply Chain Attack](https://unit42.paloaltonetworks.com/axios-supply-chain-attack/ "article - table of contents")
* [The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time](https://unit42.paloaltonetworks.com/real-time-malicious-javascript-through-llms/ "article - table of contents")
## Related Malware Resources
[High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) October 22, 2026 [#### EMudhra Intermediate CA Certificates Compromised](https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/)
* [Certificates](https://unit42.paloaltonetworks.com/tag/certificates/ "certificates")
* [Compromise](https://unit42.paloaltonetworks.com/tag/compromise/ "Compromise")
* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")
[Read now ](https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/ "EMudhra Intermediate CA Certificates Compromised")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 21, 2026 [#### "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities](https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/)
* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")
* [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration")
* [DeepSeek](https://unit42.paloaltonetworks.com/tag/deepseek/ "DeepSeek")
[Read now ](https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/ "“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 15, 2026 [#### AI-Powered Espionage Campaign Targets Government Linux Infrastructure](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/)
* [Exfiltration](https://unit42.paloaltonetworks.com/tag/exfiltration/ "exfiltration")
* [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM")
* [Network security](https://unit42.paloaltonetworks.com/tag/network-security/ "network security")
[Read now ](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ "AI-Powered Espionage Campaign Targets Government Linux Infrastructure")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 14, 2026 [#### Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)
* [Apache](https://unit42.paloaltonetworks.com/tag/apache/ "Apache")
* [CL-STA-0954](https://unit42.paloaltonetworks.com/tag/cl-sta-0954/ "CL-STA-0954")
* [Logging](https://unit42.paloaltonetworks.com/tag/logging/ "logging")
[Read now ](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 6, 2026 [#### Blinder Tunnel Campaign Targets Iraqi Infrastructure](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/)
* [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat")
* [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens")
* [AppDomainManager](https://unit42.paloaltonetworks.com/tag/appdomainmanager/ "AppDomainManager")
[Read now ](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/ "Blinder Tunnel Campaign Targets Iraqi Infrastructure")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 29, 2026 [#### OperTraitors: How Kubernetes Operators Betray Your Security Posture](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/)
* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")
* [AI agents](https://unit42.paloaltonetworks.com/tag/ai-agents/ "AI agents")
* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")
[Read now ](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/ "OperTraitors: How Kubernetes Operators Betray Your Security Posture")
[Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/)
* [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS")
* [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence")
* [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42")
[Read now ](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)
* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")
* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")
* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")
[Read now ](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)
* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")
* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")
* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")
[Read now ](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)
* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")
* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")
* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")
[Read now ](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")
* 
* 
 ![Enlarged Image]()
 Get updates from Unit 42
## Peace of mind comes from staying ahead of threats. Subscribe today.
Your Email
Subscribe for email updates to all Unit 42 threat research.
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")
This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.
Invalid captcha!
Subscribe  
{#footer} Products and Services
* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)
* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)
* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)
* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)
* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)
* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)
* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)
* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)
* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)
* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)
* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)
* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)
* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)
* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)
* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)
* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)
* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)
* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)
* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)
* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)
* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)
* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)
* [Prisma SASE](https://www.paloaltonetworks.com/sase)
* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)
* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)
* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)
* [Prisma Access](https://www.paloaltonetworks.com/sase/access)
* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)
* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)
* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)
* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)
* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)
* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)
* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)
* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)
* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)
* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)
* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)
* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)
* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)
* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)
* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)
* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)
* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response)
* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)
* Observability
* [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor)
* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)
* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)
* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)
* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)
* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)
* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)
* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)
* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)
* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)
* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)
* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)
* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)
* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense)
* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)
* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)
* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)
* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)
Company
* [About Us](https://www.paloaltonetworks.com/about-us)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)
* [Customers](https://www.paloaltonetworks.com/customers)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)
Popular Links
* [Blog](https://www.paloaltonetworks.com/blog/)
* [Communities](https://www.paloaltonetworks.com/communities)
* [Content Library](https://www.paloaltonetworks.com/resources)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center-subscribe.html)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)
* [Sitemap](https://www.paloaltonetworks.com/sitemap)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)
* [Documents](https://www.paloaltonetworks.com/legal)
Copyright © 2026 Palo Alto Networks. All Rights Reserved
* [](https://www.youtube.com/user/paloaltonetworks)
* [](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [](https://www.facebook.com/PaloAltoNetworks/)
* [](https://www.linkedin.com/company/palo-alto-networks)
* [](https://twitter.com/PaloAltoNtwks)
* EN
Select your language
   
### Default Heading
Read the article 
Seekbar
 
Volume
