[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/)
* [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/clickfix-generator-first-of-its-kind/)
* [French](https://unit42.paloaltonetworks.com/fr/clickfix-generator-first-of-its-kind/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/clickfix-generator-first-of-its-kind/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Business Email Compromise](https://unit42.paloaltonetworks.com/category/business-email-compromise/ "Business Email Compromise")  
  [Business Email Compromise](https://unit42.paloaltonetworks.com/category/business-email-compromise/)

# The ClickFix Factory: First Exposure of IUAM ClickFix Generator

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 10 min read  
Related Products  
[![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Amer Elsad](https://unit42.paloaltonetworks.com/author/amer-elsad/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:October 8, 2025

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Business Email Compromise](https://unit42.paloaltonetworks.com/category/business-email-compromise/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Bash](https://unit42.paloaltonetworks.com/tag/bash/)
  * [ClickFix](https://unit42.paloaltonetworks.com/tag/clickfix/)
  * [Phishing Kit](https://unit42.paloaltonetworks.com/tag/phishing-kit/)
  * [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/)
  * [Remote Access Trojan](https://unit42.paloaltonetworks.com/tag/remote-access-trojan/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/?pdf=download&lg=en&_wpnonce=40dbae5d0f "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/?pdf=print&lg=en&_wpnonce=40dbae5d0f "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=The%20ClickFix%20Factory:%20First%20Exposure%20of%20IUAM%20ClickFix%20Generator&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fclickfix-generator-first-of-its-kind%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fclickfix-generator-first-of-its-kind%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fclickfix-generator-first-of-its-kind%2F&title=The%20ClickFix%20Factory:%20First%20Exposure%20of%20IUAM%20ClickFix%20Generator "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fclickfix-generator-first-of-its-kind%2F&text=The%20ClickFix%20Factory:%20First%20Exposure%20of%20IUAM%20ClickFix%20Generator "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fclickfix-generator-first-of-its-kind%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=The%20ClickFix%20Factory:%20First%20Exposure%20of%20IUAM%20ClickFix%20Generator%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fclickfix-generator-first-of-its-kind%2F "Share in Mastodon")

## Executive Summary

Attackers are packaging a highly effective social engineering technique known as ClickFix into easy-to-use phishing kits, making it accessible to a wider range of threat actors. This technique tricks victims into bypassing security measures by manually executing malware, typically information stealers and remote access Trojans (RATs). The commoditization of this technique follows the trend of phishing-as-a-service, lowering the skill and effort required to conduct successful attacks.

We have uncovered a phishing kit named the IUAM ClickFix Generator that automates the creation of these attacks. The kit is designed to generate highly customizable phishing pages that lure victims by mimicking browser verification challenges often used to block automated traffic. It includes advanced features such as operating system detection and clipboard injection, enabling low-effort, cross-platform malware deployment.

We have seen at least one campaign where attackers used pages generated by the IUAM ClickFix Generator to deploy the DeerStealer malware. Furthermore, our observation of several other pages with slight technical and visual differences points to a larger trend. This suggests adversaries are building a growing commercial ecosystem to monetize this technique through competing ClickFix-themed phishing kits.

Palo Alto Networks customers are better protected from this activity through the following products and services:

* [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known domains and URLs associated with this activity as malicious.
* The [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research.
* [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM)

If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html).

| **Related Unit 42 Topics** | [**ClickFix**](https://unit42.paloaltonetworks.com/tag/clickfix/), **[Phishing](https://unit42.paloaltonetworks.com/tag/phishing/)** |
|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------|

## A Glimpse Behind the Curtain: The ClickFix Assembly Line

We identified a publicly exposed phishing kit generator hosted on an HTTP server at IP address 38.242.212\[.\]5, first observed on July 18, 2025. It remained active through early October.

The server hosts a web application on TCP port 3000, developed using the Express framework and styled with Tailwind CSS. The application serves an HTML page titled IUAM ClickFix Generator.

This tool allows threat actors to create highly customizable phishing pages that mimic the challenge-response behavior of a browser verification page commonly deployed by Content Delivery Networks (CDNs) and cloud security providers to defend against automated threats. The spoofed interface is designed to appear legitimate to victims, increasing the effectiveness of the lure.

An actor can configure every detail through a simple user interface (Figure 1), including:

* **Site and message configuration**
  * Allows customization of the phishing page title (default: "Just a moment...") and domain
  * Includes editable page message, widget text, footer notes and success or error prompts to lure or instruct victims
* **Clipboard configuration**
  * Defines the content automatically copied to the victim's clipboard upon clicking verification prompts, typically a malicious command for them to paste and execute
* **Mobile blocking and security popover**
  * Detects mobile access and prompts victims to switch to desktop browsers and edit the core instructional component presented to them (security popover)
* **Advanced settings**
  * Enables obfuscation techniques and automatic clipboard-copy JavaScript injection
  * Includes OS detection to tailor commands for Windows (Command Prompt or PowerShell) or macOS (Terminal)

![Screenshots IUAM ClickFix generator, a "professional phishing page configuration tool." Detailed settings include checkbox selections, numeric values, and dropdown menus for customization and security features.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/word-image-717079-160134-1.png) Figure 1. User interface for the IUAM ClickFix Generator phishing kit.

## From the Factory to the Frontlines: Real-World Campaigns

Our analysis indicates that attackers have used the identified phishing kit (or closely related variants) to generate a range of ClickFix-themed phishing pages. These pages share a consistent visual theme spoofing the browser verification challenges commonly deployed by CDN and web security platforms. These pages also leverage tailored OS detection and command-copy mechanisms to socially engineer victims into manually executing malware payloads.

However, not all phishing pages identified share the same structure or behavior. While we confirmed at least one case where attackers delivered DeerStealer using a page this tool generated, we also saw several other phishing pages that differ slightly in technical implementation and visual design. These differences include:

* Structural variations in the HTML/DOM layout
* Modified or entirely different command copy mechanisms
* Lack of specific JavaScript logic (e.g., OS detection, dynamic instructions)
* Simplified or inconsistent spoofing of browser challenge pages

These discrepancies suggest there are multiple variants of the ClickFix kit, or there could be distinct phishing toolkits inspired by the same lure concept but built independently or derived from earlier versions.

Below are examples showcasing the range of ClickFix phishing pages we discovered, each demonstrating slightly different levels of sophistication, behavior and delivery mechanisms.

### Campaign 1: The Windows-Only Attack (DeerStealer)

In one campaign, attackers configured the kit for a focused attack on Windows users. The threat actor included no OS detection logic in this setup. As a result, they didn't configure the page to provide alternative commands or specific instructions for macOS or other non-Windows users.

When a victim interacts with the CAPTCHA element (Figure 2) by clicking a checkbox to determine whether they are human, this action triggers a background JavaScript to copy a malicious PowerShell command to their clipboard. Simultaneously, a popover appears, instructing them to open the Windows Run dialog (by pressing Win+R), paste the content from their clipboard and run the command. Once they follow these instructions, the command downloads and runs a multi-stage batch script that ultimately installs the DeerStealer infostealer.
![Screenshot of a Cloudflare verification CAPTCHA prompt asking the user to press specific keys to confirm they are not a robot. Instructions and a CAPTCHA ID are visible.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/word-image-720527-160134-2.png) Figure 2. Campaign 1 - ClickFix page delivering DeerStealer.

Figure 3 below shows the copied command we observed.
![Screenshot of a command line script with a command to invoke a network request to a specified IP address and execute a batch file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/word-image-724213-160134-3.png) Figure 3. DOM structure showing the command copied to victim clipboard.

When executed, this command downloads a [batch script](https://www.virustotal.com/gui/file/2b74674587a65cfc9c2c47865ca8128b4f7e47142bd4f53ed6f3cb5cf37f7a6b) cv.bat (SHA256: 2b74674587a65cfc9c2c47865ca8128b4f7e47142bd4f53ed6f3cb5cf37f7a6b) to the victim's temporary directory and immediately runs it.

Analysis of the batch script reveals a multi-stage process designed to download and execute a [malicious MSI file](https://www.virustotal.com/gui/file/ead6b1f0add059261ac56e9453131184bc0ae2869f983b6a41a1abb167edf151) (SHA256: ead6b1f0add059261ac56e9453131184bc0ae2869f983b6a41a1abb167edf151) identified as the DeerStealer infostealer.

### Campaign 2: Multi-Platform Attack (Odyssey Infostealer)

In another case we observed (Figure 4), the threat actor deployed three variations of the phishing page. These all ultimately lead to the delivery of Odyssey infostealer for macOS users and an as-yet unidentified malware strain for Windows users. Despite these variations, the core structure of the phishing page remained consistent.
![Screenshot of a security verification page from speedtestcheck.org, displaying a message about unusual web traffic detected from the user's IP address. The page includes instructions on how to verify human identity by entering commands into a computer terminal, and features a "I am not a robot" checkbox and a "Copy" button for copying the command text.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/word-image-727488-160134-4.png) Figure 4. Campaign 2 - ClickFix page delivering Odyssey for macOS.

Each version of the phishing page detects the victim's operating system via JavaScript, specifically by parsing the browser's navigator.userAgent string, and delivers a payload accordingly.

While the visible text (Figure 4) suggests a harmless string, clicking the Copy button executes JavaScript that places a malicious command into the clipboard, not the one visually displayed.

The specific commands and targets vary between different versions of this phishing page.

**Variation 1: Multi-platform Windows and macOS Payload**

In multi-platform variants, attackers serve Windows users a malicious PowerShell command designed to download and execute an unidentified malware strain. They serve macOS users a Base64-encoded command to deliver Odyssey (Figure 5).
![Screenshot of a computer code snippet in a text editor displaying conditional statements in JavaScript that handle copy commands based on the user's operating system, including Mac, Windows, and an unknown OS. The code includes comments and command lines for each condition.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/word-image-730205-160134-5.png) Figure 5. DOM structure showing a multi-platform example.

Examples of domains that hosted this variant include:

* tradingview.connect-app\[.\]us\[.\]com
* treadingveew.dekstop-apps\[.\]com
* treadingveew.last-desk\[.\]org

#### Variation 2: macOS-Targeted Variant with Windows Decoy and Fallback Handling

In other variants that appear to be macOS-focused, macOS users receive a Base64-encoded command to deliver Odyssey. Windows users receive a PowerShell command as a benign decoy intended to complete the social engineering lure without delivering a payload. These PowerShell commands sometimes use domains with Cyrillic characters that visually mimic Latin ones to appear legitimate (Figure 6 and 7).

And for people using unknown operating systems (i.e., when OS detection fails), the phishing page displays a benign-looking command that also results in no malicious activity (Figure 6 and 7).
![Screenshot of a code snippet involving variables and different commands related to CloudFlare.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/word-image-734653-160134-6.png) Figure 6. DOM structure of the phishing page showing OS conditioned commands. ![Screenshot of a code snippet featuring JavaScript commands used for terminal commands, to handle different operating systems, and a variable currentThemeIsDark focused on Windows OS.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/word-image-737653-160134-7.png) Figure 7. DOM structure of the phishing page showing OS conditioned commands.

Examples of domains that hosted this variant include:

* claudflurer\[.\]com
* teamsonsoft\[.\]com

#### Variation 3: macOS Exclusive Delivering Odyssey Only

Another variant appears to be exclusively macOS-focused, providing only a single Base64-encoded command that downloads and executes Odyssey, with no configurations for other operating systems (Figure 8).
![Screenshot of a code snippet featuring JavaScript commands used for terminal commands.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/word-image-740616-160134-8.png) Figure 8. macOS-focused example with no OS specification.

This command downloads and executes a macOS Odyssey infostealer. It also uses nohup bash, which starts a new Bash shell in the background that ignores hang ups (HUP signals), so it keeps running even if the terminal is closed.

Examples of domains or IP addresses that hosted this variant include:

* emailreddit\[.\]com
* hxxps\[:\]//188.92.28\[.\]186
* cloudlare-lndex\[.\]com
* tradingviewen\[.\]com

## Shared Origins and Developer Artifacts

Despite differences in targeting logic and payload delivery URLs, all analyzed phishing pages in Campaign 2 share an identical underlying structure, including a consistent HTML layout and JavaScript function naming.

Furthermore, while the specific command-and-control (C2) server address varied between the pages, Our analysis confirmed that, although the specific command-and-control (C2) server address varied between pages, all were Odyssey C2 servers.

This consistency in both the page structure and C2 infrastructure strongly suggests that these variants are part of the same activity cluster and likely originate from a shared codebase or builder tool.

Odyssey is a malware-as-a-service (MaaS) offering operated by a cybercrime actor active on dark web forums such as Exploit and XSS, known to collaborate with other actors and affiliates. As such, it is plausible that these phishing page variations reflect customized deployments of a base toolkit distributed by the malware operator or their affiliates.

According to posts published by the actor who advertises and operates the Odyssey MaaS, the actor has allegedly supplied ClickFix-style lure pages to affiliates upon request. This further supports the theory that these variants originate from a common generator tool but are tailored per affiliate, campaign or individual preferences.

Additionally, some pages contained leftover developer comments written in Russian (Figure 9 and 10).
![A screenshot of computer code including a JavaScript function named notifyClick, which sends a click notification using the fetch API to 'stats.php'. The code includes a comment in Cyrillic characters that translates to 'Function for sending a click notification'.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/word-image-743312-160134-9.png) Figure 9. Russian leftover developer comment.

English translation of this Russian comment in Figure 9: Add a call to stats.php when the page loads.
![Screenshot of a comment in Cyrillic characters as part of a code snippet in a script tag that adds a 'stats.php' fetch call when a web page loads.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/word-image-745751-160134-10.png) Figure 10. Russian leftover developer comment.

English translation of the Russian comment in Figure 10: Function for sending click notification.

Ultimately, the structural consistency across all samples strongly indicates they were generated from a single, configurable phishing kit, with every malicious variant designed to deliver the Odyssey infostealer malware.

## Conclusion

The discovery of the IUAM ClickFix Generator provides a rare glimpse into the tooling that lowers the barrier to entry for cybercriminals, enabling them to launch sophisticated, multi-platform attacks without deep technical expertise. The ClickFix technique's effectiveness relies on exploiting a user's instinct to follow onscreen instructions from what appears to be a trusted security provider.

This threat underscores the importance of user awareness and vigilance. Individuals and organizations should be cautious of any website that instructs them to manually copy and execute commands to prove they are human. This simple but deceptive social engineering tactic is a growing threat that turns a person's actions into the primary infection vector.

### Palo Alto Networks Protection and Mitigation

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

* [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known domains and URLs associated with this activity as malicious.
* The [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research.
* [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) are designed to prevent the malware samples described in this post by employing the [Malware Prevention Engine](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection). This approach combines several layers of protection, including [Advanced WildFire](https://docs.paloaltonetworks.com/advanced-wildfire), Behavioral Threat Protection and the Local Analysis module, to prevent both known and unknown malware from causing harm to endpoints. The mitigation methods implement malware protection based on different operating systems: Windows, macOS and Linux.

If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:

* North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
* UK: +44.20.3743.3660
* Europe and Middle East: +31.20.299.3130
* Asia: +65.6983.8730
* Japan: +81.50.1790.0200
* Australia: +61.2.4062.7950
* India: 000 800 050 45107

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org).

## Indicators of Compromise

Table 1 lists SHA256 hashes for 18 Odyssey malware samples and eight DeerStealer samples associated with the ClickFix activity from this threat research article.

|------------------------------------------------------------------|-------------|
| **SHA256 Hash**                                                  | **Malware** |
| 397ee604eb5e20905605c9418838aadccbbbfe6a15fc9146442333cfc1516273 | Odyssey     |
| 7a8250904e6f079e1a952b87e55dc87e467cc560a2694a142f2d6547ac40d5e1 | Odyssey     |
| 7765e5e0a7622ff69bd2cee0a75f2aae05643179b4dd333d0e75f98a42894065 | Odyssey     |
| d81cc9380673cb36a30f2a84ef155b0cbc7958daa6870096e455044fba5f9ee8 | Odyssey     |
| 9c5920fa25239c0f116ce7818949ddce5fd2f31531786371541ccb4886c5aeb2 | Odyssey     |
| 9090385242509a344efd734710e60a8f73719130176c726e58d32687b22067c8 | Odyssey     |
| 8ed8880f40a114f58425e0a806b7d35d96aa18b2be83dede63eff0644fd7937d | Odyssey     |
| 7881a60ee0ad02130f447822d89e09352b084f596ec43ead78b51e331175450f | Odyssey     |
| d375bb10adfd1057469682887ed0bc24b7414b7cec361031e0f8016049a143f9 | Odyssey     |
| 039f82e92c592f8c39b9314eac1b2d4475209a240a7ad052b730f9ba0849a54a | Odyssey     |
| 82b73222629ce27531f57bae6800831a169dff71849e1d7e790d9bd9eb6e9ee7 | Odyssey     |
| d110059f5534360e58ff5f420851eb527c556badb8e5db87ddf52a42c1f1fe76 | Odyssey     |
| 816bf9ef902251e7de73d57c4bf19a4de00311414a3e317472074ef05ab3d565 | Odyssey     |
| 72633ddb45bfff1abeba3fc215077ba010ae233f8d0ceff88f7ac29c1c594ada | Odyssey     |
| cd78a77d40682311fd30d74462fb3e614cbc4ea79c3c0894ba856a01557fd7c0 | Odyssey     |
| 00c953a678c1aa115dbe344af18c2704e23b11e6c6968c46127dd3433ea73bf2 | Odyssey     |
| fe8b1b5b0ca9e7a95b33d3fcced833c1852c5a16662f71ddea41a97181532b14 | Odyssey     |
| 966108cf5f3e503672d90bca3df609f603bb023f1c51c14d06cc99d2ce40790c | Odyssey     |
| 029a5405bbb6e065c8422ecc0dea42bb2689781d03ef524d9374365ebb0542f9 | DeerStealer |
| 081921671d15071723cfe979633a759a36d1d15411f0a6172719b521458a987d | DeerStealer |
| 2b74674587a65cfc9c2c47865ca8128b4f7e47142bd4f53ed6f3cb5cf37f7a6b | DeerStealer |
| 6e4119fe4c8cf837dac27e2948ce74dc7af3b9d4e1e4b28d22c4cf039e18b993 | DeerStealer |
| ba5305e944d84874bde603bf38008675503244dc09071d19c8c22ded9d4f6db4 | DeerStealer |
| f2a068164ed7b173f17abe52ad95c53bccf3bb9966d75027d1e8960f7e0d43ac | DeerStealer |
| 3aee8ad1a30d09d7e40748fa36cd9f9429e698c28e2a1c3bcf88a062155eee8c | DeerStealer |
| ead6b1f0add059261ac56e9453131184bc0ae2869f983b6a41a1abb167edf151 | DeerStealer |

Table 1. Malware samples associated with the ClickFix campaigns from this article.

Table 2 lists the IPv4 addresses for C2 servers used by Odyssey malware samples from this article.

|--------------------|----------------|---------------|-------------|
| **IP Address**     | **First Seen** | **Last Seen** | **Malware** |
| 45.146.130\[.\]129 | 2025-07-22     | 2025-07-28    | Odyssey     |
| 45.135.232\[.\]33  | 2025-06-15     | 2025-07-18    | Odyssey     |
| 83.222.190\[.\]214 | 2025-05-23     | 2025-08-10    | Odyssey     |
| 194.26.29\[.\]217  | 2025-06-22     | 2025-06-24    | Odyssey     |
| 88.214.50\[.\]3    | 2025-04-14     | 2025-05-16    | Odyssey     |
| 45.146.130\[.\]132 | 2025-07-01     | 2025-07-28    | Odyssey     |
| 45.146.130\[.\]131 | 2025-07-03     | 2025-07-28    | Odyssey     |
| 185.93.89\[.\]62   | 2025-07-29     | 2025-09-18    | Odyssey     |

Table 2. IPv4 addresses for C2 servers.

Table 3 lists the fully qualified domain names (FQDNs) associated with the malware discussed in this article.

|------------------------------------|------------------------|
| **Domain**                         | **Associated Malware** |
| Odyssey1\[.\]to                    | Odyssey                |
| Odyssey-st\[.\]com                 | Odyssey                |
| sdojifsfiudgigfiv\[.\]to           | Odyssey                |
| Charge0x\[.\]at                    | Odyssey                |
| speedtestcheck\[.\]org             | Odyssey                |
| claudflurer\[.\]com                | Odyssey                |
| teamsonsoft\[.\]com                | Odyssey                |
| Macosapp-apple\[.\]com             | Odyssey                |
| tradingview.connect-app.us\[.\]com | Odyssey                |
| treadingveew.last-desk\[.\]org     | Odyssey                |
| tradingviewen\[.\]com              | Odyssey                |
| financementure\[.\]com             | Odyssey                |
| Cryptoinfnews\[.\]com              | Odyssey                |
| Emailreddit\[.\]com                | Odyssey                |
| Macosxappstore\[.\]com             | Odyssey                |
| Cryptoinfo-news\[.\]com            | Odyssey                |
| Cryptoinfo-allnews\[.\]com         | Odyssey                |
| apposx\[.\]com                     | Odyssey                |
| ttxttx\[.\]com                     | Odyssey                |
| Greenpropertycert\[.\]com          | Odyssey                |
| cloudlare-lndex\[.\]com            | Odyssey                |
| Dactarhome\[.\]com                 | Odyssey                |
| ibs-express\[.\]com                | Odyssey                |
| favorite-hotels\[.\]com            | DeerStealer            |
| watchlist-verizon\[.\]com          | DeerStealer            |
| Growsearch\[.\]in                  | DeerStealer            |
| Creatorssky\[.\]com                | DeerStealer            |
| quirkyrealty\[.\]com               | DeerStealer            |
| Sharanilodge\[.\]com               | DeerStealer            |
| asmicareer\[.\]com                 | DeerStealer            |
| crm.jskymedia\[.\]com              | DeerStealer            |
| coffeyelectric\[.\]com             | DeerStealer            |
| Sifld.rajeshmhegde\[.\]com         | DeerStealer            |
| Pixelline\[.\]in                   | DeerStealer            |
| techinnovhub\[.\]co\[.\]za         | DeerStealer            |
| fudgeshop\[.\]com\[.\]au           | DeerStealer            |
| evodigital\[.\]com\[.\]au          | DeerStealer            |
| 365-drive\[.\]com                  | DeerStealer            |

Table 3. FQDNs associated with the malware discussed in this article.

**Note:** In some cases, the ClickFix-style phishing page is not hosted on a domain the threat actor registered, but instead injected into a legitimate website that they've compromised. The actor adds a malicious JavaScript snippet that performs several DOM manipulations, including injecting the ClickFix phishing lure. They style this using Tailwind CSS, which overrides the site's original layout and appearance to fully render the phishing content in place of the legitimate one.
Back to top

### Tags

* [Bash](https://unit42.paloaltonetworks.com/tag/bash/ "bash")
* [ClickFix](https://unit42.paloaltonetworks.com/tag/clickfix/ "ClickFix")
* [Phishing Kit](https://unit42.paloaltonetworks.com/tag/phishing-kit/ "Phishing Kit")
* [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell")
* [Remote Access Trojan](https://unit42.paloaltonetworks.com/tag/remote-access-trojan/ "Remote Access Trojan")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Responding to Cloud Incidents: A Step-by-Step Guide From the 2025 Unit 42 Global Incident Response Report](https://unit42.paloaltonetworks.com/responding-to-cloud-incidents/ "Responding to Cloud Incidents: A Step-by-Step Guide From the 2025 Unit 42 Global Incident Response Report")

### Table of Contents

* 

### Related Articles

* [Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "article - table of contents")
* [Tracking TamperedChef Clusters via Certificate and Code Reuse](https://unit42.paloaltonetworks.com/tracking-tampered-chef-clusters/ "article - table of contents")
* [That AI Extension Helping You Write Emails? It's Reading Them First](https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/ "article - table of contents")

## Related Business Email Compromise Resources

![Pictorial representation of a group of individuals discussing an idea with a whiteboard.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/02_Listicle_Overview_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) February 3, 2026 [#### Why Smart People Fall For Phishing Attacks](https://unit42.paloaltonetworks.com/psychology-of-phishing/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/psychology-of-phishing/ "Why Smart People Fall For Phishing Attacks")  
  ![Pictorial representation of phishing bait using AI. A luminous cube labeled "AI" centrally placed on a futuristic circuit board landscape with glowing blue lights and connections.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/03_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 19, 2025 [#### Fashionable Phishing Bait: GenAI on the Hook](https://unit42.paloaltonetworks.com/genai-phishing-bait/)

* [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI")

* [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/genai-phishing-bait/ "Fashionable Phishing Bait: GenAI on the Hook")  
  ![Pictorial representation of social engineering. Digital illustration of four human profiles connected by glowing neural network lines against a dark background, symbolizing connectivity and technology.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/cover-1920x900-no-blades-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-report-white-1.svg)Trend Reports](https://unit42.paloaltonetworks.com/category/trend-reports/) July 30, 2025 [#### 2025 Unit 42 Global Incident Response Report: Social Engineering Edition](https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/)

* [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens")

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ClickFix](https://unit42.paloaltonetworks.com/tag/clickfix/ "ClickFix")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/ "2025 Unit 42 Global Incident Response Report: Social Engineering Edition")  
  ![Pictorial representation of homograph attacks. 3D illustration of an open laptop displaying an envelope icon on the screen, accompanied by a smartphone and tablet, all set against a dark background with neon lighting.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/01_Business_email_compromise_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 25, 2025 [#### The Ηоmоgraph Illusion: Not Everything Is As It Seems](https://unit42.paloaltonetworks.com/homograph-attacks/)

* [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI")

* [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/homograph-attacks/ "The Ηоmоgraph Illusion: Not Everything Is As It Seems")  
  ![Pictorial representation of the ransomware landscape. Digital artwork of a disintegrating U.S. dollar bill with pixelated effects on a cyber-inspired background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/05_Ransomware_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-report-white-1.svg)Trend Reports](https://unit42.paloaltonetworks.com/category/trend-reports/) April 23, 2025 [#### Extortion and Ransomware Trends January-March 2025](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/)

* [BianLian](https://unit42.paloaltonetworks.com/tag/bianlian/ "BianLian")

* [Akira ransomware](https://unit42.paloaltonetworks.com/tag/akira-ransomware/ "Akira ransomware")

* [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/ "Extortion and Ransomware Trends January-March 2025")  
  ![Pictorial representation of a QR code phishing campaign. Digital artwork of a futuristic, glowing shield disintegrating into small particles, set against a dark blue, speckled background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/09_Business_email_compromise_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 1, 2025 [#### Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon](https://unit42.paloaltonetworks.com/qr-code-phishing/)

* [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing")

* [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/ "social engineering")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/qr-code-phishing/ "Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon")  
  ![An Asian woman examining data on multiple computer screens in a high-tech digital environment, surrounded by visual representations of data and code. Lens flare is prominent across the image.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/07_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) February 28, 2025 [#### JavaGhost's Persistent Phishing Attacks From the Cloud](https://unit42.paloaltonetworks.com/javaghost-cloud-phishing/)

* [AWS](https://unit42.paloaltonetworks.com/tag/aws/ "AWS")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/javaghost-cloud-phishing/ "JavaGhost’s Persistent Phishing Attacks From the Cloud")  
  ![Pictorial representation of a European phishing campaign. A digital artwork depicting a glowing, futuristic shield disintegrating into small fragments against a shimmering blue background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/09_Business_email_compromise_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 18, 2024 [#### Effective Phishing Campaign Targeting European Companies and Organizations](https://unit42.paloaltonetworks.com/european-phishing-campaign/)

* [EMEA](https://unit42.paloaltonetworks.com/tag/emea/ "EMEA")

* [Manufacturing](https://unit42.paloaltonetworks.com/tag/manufacturing/ "Manufacturing")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/european-phishing-campaign/ "Effective Phishing Campaign Targeting European Companies and Organizations")  
  ![A pictorial representation of a campaign like BeaverTail. Digital globe with interconnected network lines and data streams on a futuristic interface, symbolizing global connectivity and information technology advancements.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/01_Nation-State-cyberattacks_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) November 14, 2024 [#### Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack](https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/)

* [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/ "North Korea")

* [Lazarus](https://unit42.paloaltonetworks.com/tag/lazarus/ "Lazarus")

* [BeaverTail](https://unit42.paloaltonetworks.com/tag/beavertail/ "BeaverTail")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/ "Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)