[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 11 min read Related Products [![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Pranay Kumar Chhaparwal](https://unit42.paloaltonetworks.com/author/pranay-kumar-chhaparwal/) * [Benjamin Chang](https://unit42.paloaltonetworks.com/author/benjamin-chang/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:May 14, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [AutoIT](https://unit42.paloaltonetworks.com/tag/autoit/) * [Infostealer](https://unit42.paloaltonetworks.com/tag/infostealer/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/darkcloud-stealer-and-obfuscated-autoit-scripting/?pdf=download&lg=en&_wpnonce=f6e4b1f2e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/darkcloud-stealer-and-obfuscated-autoit-scripting/?pdf=print&lg=en&_wpnonce=f6e4b1f2e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=DarkCloud%20Stealer:%20Comprehensive%20Analysis%20of%20a%20New%20Attack%20Chain%20That%20Employs%20AutoIt&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkcloud-stealer-and-obfuscated-autoit-scripting%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkcloud-stealer-and-obfuscated-autoit-scripting%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkcloud-stealer-and-obfuscated-autoit-scripting%2F&title=DarkCloud%20Stealer:%20Comprehensive%20Analysis%20of%20a%20New%20Attack%20Chain%20That%20Employs%20AutoIt "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkcloud-stealer-and-obfuscated-autoit-scripting%2F&text=DarkCloud%20Stealer:%20Comprehensive%20Analysis%20of%20a%20New%20Attack%20Chain%20That%20Employs%20AutoIt "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkcloud-stealer-and-obfuscated-autoit-scripting%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=DarkCloud%20Stealer:%20Comprehensive%20Analysis%20of%20a%20New%20Attack%20Chain%20That%20Employs%20AutoIt%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fdarkcloud-stealer-and-obfuscated-autoit-scripting%2F "Share in Mastodon") ## Executive Summary In January 2025, Unit 42 researchers identified a series of attacks distributing DarkCloud Stealer. The latest attack chain incorporated AutoIt to evade detection and used a file-sharing server to host the malware. This article explores the chain of events from these recent campaigns and analyzes the characteristics of these attacks. DarkCloud employs multi-stage payloads and obfuscated AutoIt scripting, making its detection challenging with traditional signature-based methods. Its ability to extract sensitive data and establish command and control (C2) communications highlights the importance of thorough detection and assessment. Palo Alto Networks customers are better protected from DarkCloud Stealer through our [Network Security](https://www.paloaltonetworks.com/network-security) solutions and [Cortex](https://www.paloaltonetworks.com/cortex) line of products including [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire), [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [Cortex XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM). If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Infostealers**](https://unit42.paloaltonetworks.com/tag/infostealer/), **[AutoIt](https://unit42.paloaltonetworks.com/tag/autoit/)** | |----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------| ## History of DarkCloud Stealer The threat author has advertised DarkCloud Stealer in hacking forums [as early as January 2023](https://cyble.com/blog/decoding-the-inner-workings-of-darkcloud-stealer/). Our telemetry reveals that attackers distributing DarkCloud Stealer have targeted various sectors but have notably focused on government organizations. A [February 2025 report](https://cert.orange.pl/aktualnosci/dark-cloud-nowy-stealer-w-polskiej-sieci/) from a Polish telecommunications provider notes that DarkCloud Stealer has appeared in attacks against machines in Poland. Initially spotted in 2022, this information stealer is designed to capture sensitive browser data like credit card information, login credentials and other personal data. The malware is predominantly distributed through email phishing campaigns and is currently undergoing active development. ## Activity Timeline We have been monitoring this malware family since its appearance in 2022, and we have observed multiple samples that we believe are new variants of DarkCloud Stealer in late January 2025. Figure 1 shows a timeline displaying the sample count of the newly observed DarkCloud variant in January and February of 2025. :chart: Figure 1. Timeline of new DarkCloud variant samples observed. Figure 2 shows one of the samples, an AutoIt-compiled Portable Executable (PE) file in an analysis tool. Figure 3 shows the same sample in another analysis tool. Both tools confirm this sample is an AutoIt compiled PE file. ![Screenshot of a software interface showing a highlighted section named "TimeDateStamp" with the value "2025-01-31 18:12:40". Additionally, the software identifies it as "Microsoft Visual C++(2013). AutoIt is also highlighted in red.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-888607-140509-2.png) Figure 2. Compiled AutoIt PE file as detected by [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy). ![Screenshot of a hexadecimal editor displaying various bytes of data with some sections in ASCII format highlighted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-891732-140509-3.png) Figure 3. AutoIt compiled script magic bytes in the RCData PE resource as shown by [CFF Explorer](https://ntcore.com/explorer-suite/). ## Delivery Mechanism and Updated Infection Chain We have observed many different attack chains that vary slightly. Since the variations in the attack chains are minor, we are illustrating just two possible attack chains for this article. This attack chain starts with a phishing email. As shown in Figure 4, the email might contain a RAR archive or a phishing PDF that eventually downloads the RAR archive. The RAR archive contains an executable file that eventually delivers the malicious payload. The multi-step nature of this attack underscores its intricacy and stealth. The stages of this attack are: 1. A phishing email containing either a RAR archive or a phishing PDF 1. In the case of an email with a phishing PDF, the PDF contains a pop-up message asking the victim to download a malicious archive disguised as a software update (from a file-sharing service URL). 2. The RAR archive contains an AutoIt compiled PE (EXE) file. 3. In addition to the AutoIt script (AU3 file), the AutoIt compiled EXE is packaged with two encrypted data files. One of the files is an encrypted shellcode, and the other file is the XORed payload. 4. The AutoIt script builds and runs the final DarkCloud Stealer payload from the two data files. ![Diagram depicting a cybersecurity threat where a phishing email with a PDF leads to a file sharing service, followed by a RAR file that contains an AutoIt EXE. This then executes encrypted shell code revealing an XORed payload, resulting in a final payload.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-895873-140509-4.png) Figure 4. Infection chain of the new DarkCloud Stealer variant. Figure 5 displays the number of these new AutoIt-based DarkCloud samples observed in various affected industries, while Figure 6 shows the geolocation of the samples we have seen\*.\* ![A horizontal bar chart illustrating the number of samples across different industries. From top to bottom, the bars represent State and Local Government with 25 samples, Federal Government with 21 samples, High Tech with 12 samples, Finance with 9 samples, Manufacturing with 6 samples, and Media and Entertainment with 3 samples. The chart is branded by Palo Alto Networks and UNIT 42.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/chart-1.png) Figure 5. A new variant of the DarkCloud Stealer, samples seen for top industries. ![Bar chart showing the number of samples from various countries. United States has 27, Brazil has 24, Peru and The Netherlands each have 8, Turkey has 4, and Hungary has 2. Palo Alto Networks and Unit 42 logo.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-905834-140509-6.png) Figure 6. Geolocation of where we saw samples. ## Technical Analysis This section delves into the attack chain in these recent DarkCloud Stealer campaigns. ### **Phishing Email to File-Sharing Service** The initial phishing email contains a [PDF file](https://www.virustotal.com/gui/file/bf3b43f5e4398ac810f005200519e096349b2237587d920d3c9b83525bb6bafc) that displays a pop-up message stating the victim's Adobe Flash Player is out of date, as shown below in Figure 7. If a victim clicks the "Download Flash" button, this downloads a RAR archive from a file-sharing service. The archive contains the malicious AutoIt compiled executable. ![PDF with identifying information is blurred in the background, supposedly for a purchase order. In the center is a popup for an Adobe Flash Player update notification, with the 'Update' and 'Download Flash' buttons visible.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-909752-140509-7.png) Figure 7. Phishing PDF file. Below, Figure 8 shows the downloaded RAR file and extracted [EXE file](https://www.virustotal.com/gui/file/9940de30f3930cf0d0e9e9c8769148594240d11242fcd6c9dd9e9f572f68ac01). ![Screenshot of a computer interface showing a WinRAR archive manager with a file named "olyfl3.rar" highlighted and an executable file for Adobe Reader installation visible.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-913618-140509-8.png) Figure 8. Downloaded RAR file and extracted sample. File-sharing services are commonly abused for malware distribution because they offer a convenient way for cybercriminals to host their malicious files. Most of these services can host files that do not require any login credentials or thorough validation of user activities, making them a useful tool in an attack chain. Another benefit for attackers using file-sharing services is that they can host and remove files for a defined period of time. If someone deletes a file from the server, the attack will eventually cease. But this is also a disadvantage, as the attackers do not have full control compared to owning their own servers. If someone deletes their file-sharing account, the attack chain breaks. In our case, the malicious RAR file is hosted on the URL hxxps\[:\]//files.catbox\[.\]moe/olyfi3.001. ### **Dropper - AutoIt Compiled Executable** A notable enhancement in this new variant is the incorporation of AutoIt compiled PE files as the dropper component. AutoIt is a legitimate scripting language for automating the Windows GUI and general scripting tasks. Over the years, criminals have abused it to hide malicious activity. We have [published various articles](https://unit42.paloaltonetworks.com/tag/autoit/) on criminal groups abusing the AutoIt platform. An AutoIt-compiled executable is typically composed of two parts: * A standalone AutoIt interpreter * The compiled script bytecode stored as a resource within the PE file The compression and encryption prevent easy decompilation of the bytecode. The compiled AutoIt binary handles the decompression of the bytecode before interpreting and executing it. To better understand how this decompression works, we can analyze the AutoIt script extracted from the AutoIt-compiled PE file. At the beginning of the AutoIt script, as illustrated in Figure 9, the [Call()](https://www.autoitscript.com/autoit3/docs/functions/Call.htm), [StringLen()](https://www.autoitscript.com/autoit3/docs/functions/StringLen.htm) and [StringMid()](https://www.autoitscript.com/autoit3/docs/functions/StringMid.htm) function pointers are assigned to obscurely named global variables using the [Execute()](https://www.autoitscript.com/autoit3/docs/functions/Execute.htm) function. The string-related global variables serve as the building blocks for a string decoding function used for additional obfuscation. ![Image showing three lines of colorful programming code with global variables and function calls, written on a dark background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-917028-140509-9.png) Figure 9. Variables assigned execution of Call() and Strings operations from the AutoIt script. Figure 10 shows the subsequent string decoding function. ![Screenshot of computer code written in a text editor, featuring a function, with obfuscation.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-920974-140509-10.png) Figure 10. String decoding function in its original obfuscated form. Figure 11 shows the deobfuscated version of the same function from Figure 10. ![Screenshot of computer code with syntax highlighting featuring a function named StringDecode.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-924232-140509-11.png) Figure 11. Manually deobfuscated string decoding function. After implementing the string decoding function, the malware author uses the function to define additional variables, as illustrated in Figure 12. These additional variables use more random names, serving as basic function executions that will be used later. ![A screenshot of computer code featuring declarations of global variables in a text editor, with syntax highlighting in purple, green, and yellow colors.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-927502-140509-12.png) Figure 12. More global variables are assigned to function execution, albeit with an added layer of obfuscation. Figure 13 displays the deobfuscated version of the same code from Figure 12. These definitions closely resemble the initial function executions presented at the start of the script, albeit with an added layer of string obfuscation. ![Image of a colorful computer code snippet showing four lines in a terminal with syntax highlighting. Each line begins with the keyword "Global" followed by a variable and an assignment that involves the "Execute" function with commands like "BinaryLen", "DllStructCreate", "DllStructSetData", and "DllStructGetPtr".](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-930875-140509-13.png) Figure 13. Deobfuscated version of global variables assigned to function execution. The AutoIt compiled EXE does not simply run the AU3 script alone. The EXE is compiled with two additional files, likely via the native AutoIt [FileInstall()](https://www.autoitscript.com/autoit3/docs/functions/FileInstall.htm) function. Specifically, in this sample, the filenames are iodization and plainstones. Upon closer examination, we see plainstones is an XOR-encrypted PE file. Iodization appears to contain a shellcode pattern. This pattern consists of a series of characters representing hex values, interspersed with a static 8-digit numeric string. Figure 14 displays a snapshot of the iodization file with the shellcode representation. Upon careful reading, the concatenated values form 0x558bec, which corresponds to the prologue of a subroutine. ![Image featuring a repeated pattern of numerical values and vertical red lines on a black background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-934085-140509-14.png) Figure 14. A data blob that decodes into a PE file. Indeed, we can locate the shellcode builder AutoIt script snippet as depicted in Figure 15. ![Screenshot of a computer screen displaying code in a text editor with syntax highlighting. The code includes variable declarations and conditional statements in a programming language.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-938580-140509-15.png) Figure 15. Code snippet for extracting shellcode from the encrypted dropped file. Additionally, the deobfuscated version of this code is shown in Figure 16. ![A screenshot displaying a script in a coding environment with variables and conditional structures. The script includes string manipulation functions and a loop, primarily in blue and green text on a black background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-943275-140509-16.png) Figure 16. Deobfuscated code snippet for extracting shell code from the encrypted dropped file. Our analysis led to the following three insights. * In some samples of this malware, the associated global variable linking to the execution of StringLower() is not defined. This could potentially be a bug in the malware authors' toolchain. * The extractShellCode() function shown above in Figure 16 includes case sensitivity as an optional parameter, although it is not used in this case. This suggests the existence of potential variants with higher levels of obfuscation that use upper and lower case letters to encrypt the binary data file. * The same extractShellCode() function also includes the capability of [bitwise AND assignment](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Bitwise_AND_assignment) (\&=) for encryption that is not used in this context. Once again, this indicates the possibility of variants with additional obfuscation methods applied to encrypt the binary data file. The AutoIt script first creates a DllStructure to host the shellcode. It then calls VirtualProtect() to change the memory protection to PAGE\_EXECUTE\_READWRITE. Finally, the script executes the shellcode using CallWindowProc(). Figure 17 displays the deobfuscated code showing these functions. Notably, the entry point of the shellcode is not at the beginning of the injected blob but at the 9168th byte (or 0x23D0 in hex), as indicated by the parameters of CallWindowProc. ![Screenshot of code with syntax highlighting that demonstrates how the shell code is executed.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-948090-140509-17.png) Figure 17. A code snippet showing how the shellcode is eventually executed. Upon examining the entry point of the shellcode, as depicted in Figure 18, we observed that soon after the 558BEC prologue, the code promptly initiates the construction of a string in memory. This string serves as the XOR decryption key for the previously mentioned plainstones file. ![A screenshot displaying a section of assembly language code with various operation commands like 'mov', 'push', and register manipulations, commonly used in software development and debugging. A section in the upper middle is highlighted in grey.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-951383-140509-18.png) Figure 18. Entry point of shellcode and string building as shown in IDA Pro. Figure 19 displays the decrypted output as a PE file. Subsequently, the shellcode builds this PE file in memory and eventually executes it. ![Screenshot of a CyberChef interface showing various cryptographic operations being performed with input, recipe, and output sections visible.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-956256-140509-19.png) Figure 19. Decrypted DarkCloud payload as shown in [CyberChef](https://gchq.github.io/CyberChef/). ### Payload - DarkCloud Executable This section shows various functionalities employed by the final DarkCloud payload. First, as shown in Figure 20 below, we can identify the final payload executable as DarkCloud Stealer because of the DARKCLOUD signature string found in the sample. ![Text on a computer screen displaying credentials including a username and password for an application named PIDGIN. Below, a file named recentServers.xml is mentioned, showing details of an FTP server including URL, host, and port. The background is dark with green text.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-959969-140509-20.png) Figure 20. Strings from the DarkCloud Stealer sample as displayed in [Hacker's View](https://www.hiew.ru/). In general, DarkCloud Stealer is a comprehensive data-stealing malware that collects and exfiltrates information such as: * Computer names * Usernames * Screenshots * Contacts * Browser passwords * Email client passwords This infostealing functionality is shown in Figure 21 below. ![Screenshot of a programming code in an IDE, featuring variables and functions, highlighted with syntax coloring. Some portions are highlighted in red boxes.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-963279-140509-21.png) Figure 21. Various infostealing capabilities of the DarkCloud payload as shown by IDA Pro. #### Stealing Browser and Mail Client Data The payload attempts to retrieve saved usernames and passwords from various Chrome-based and Gecko-based browsers. Figure 22 shows a list of folders that the DarkCloud sample iterates through to scan for files such as logins.json, key4.db and signons.sqlite. ![Code with most of the information redacted. An arrow points to the portion that hides various browser paths.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-967150-140509-22.png) Figure 22. List of targeted browser data folders (displayed in [Hacker's View](https://www.hiew.ru/)). Figure 23 shows that the malware then checks each profile from the mail client and gathers saved credentials and data. Once it collects all the data, the malware consolidates it into a single file that it can exfiltrate from the victim's machine to the C2 server. ![Image displaying a computer screen with various lines of code and data structures in a programming environment. Key terms visible include "UTF-16LE," "SOFTWARE," and references to "aData" and "LoginData". Portions redacted in green indicate a "Path to Mail Client" with arrows.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-971335-140509-23.png) Figure 23. Disassembled code showing information-stealing functions from a mail client. This sample checks for user accounts and credit card details from various Chromium-based and Gecko-based browsers. It searches for information from various types of popular credit cards, as shown in Figure 24 below. #### Credit Card Information Stealing ![The image displays two side-by-side screenshots of computer code with text and syntax highlighting, primarily featuring SQL database queries and assembly language instructions.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-974670-140509-24.png) Figure 24. Disassembled code that shows credit card information stealing functionality. #### SMTP and FTP Credential Stealing This sample attempts to retrieve saved login credentials from various FTP client applications and decrypts them for exfiltration as shown in Figure 25. ![Screenshot of code with various commands highlighted in pink and purple, and a section labeled "FTP Client Application" in a green box at the top, which is redacted in the image and indicated by an arrow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/05/word-image-979660-140509-25.png) Figure 25. Disassembled code indicating the malware steals credentials from a well-known FTP client. #### Anti-Analysis and Other Crucial Functionalities DarkCloud incorporates numerous anti-analysis techniques, including checks for analysis tools such as: * WinDbg * Fiddler * TCPView * Process Explorer * VMWare Tools * Wireshark * Process Monitor The sample uses typical junk code and fake API calls to make analysis more difficult. This sample also checks for the victim's public IP address using the web services below to obtain geolocation. * hxxp://showip\[.\]net * hxxp://www\[.\]mediacollege\[.\]com/internet/utilities/show-ip.shtml Lastly, persistence is achieved through an addition to the RunOnce registry key: * HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\ ## Conclusion DarkCloud Stealer has been active since 2022 and is continuously evolving. Attackers often modify their techniques for delivering malware, making detection and prevention more difficult. Palo Alto Networks monitors these campaigns, using a range of static and dynamic techniques to detect and prevent them. Stealers of this type are well-known elements of the threat landscape, and there are many approaches to protecting customers from these evolving attacks. These methods include dynamic and behavioral detections, as well as more reactive [signature or pattern](https://www.paloaltonetworks.com/cyberpedia/what-is-a-payload-based-signature)-based solutions. ## MITRE ATT\&CK^®^ Techniques |-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------| | **Tactic** | **Technique ID** | **Technique Name** | | Initial Access | [T1566.001](https://attack.mitre.org/techniques/T1566/) | Phishing | | Execution | [T1204](https://attack.mitre.org/techniques/T1204/) [T1053](https://attack.mitre.org/techniques/T1053/) | User Execution Scheduled Task/Job | | Persistence | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | | Defense Evasion | [T1140](https://attack.mitre.org/techniques/T1140/) | Deobfuscate/Decode Files or Information | | Credential Access | [T1555](https://attack.mitre.org/techniques/T1555/) [T1539](https://attack.mitre.org/techniques/T1539/) [T1552](https://attack.mitre.org/techniques/T1552/) [T1528](https://attack.mitre.org/techniques/T1528/) | Credentials from Password Stores Steal Web Session Cookie Unsecured Credentials Steal Application Access Token | | Discovery | [T1087](https://attack.mitre.org/techniques/T1087/) [T1518](https://attack.mitre.org/techniques/T1518/) [T1057](https://attack.mitre.org/techniques/T1057/) [T1007](https://attack.mitre.org/techniques/T1007/) | Account Discovery Software Discovery Process Discovery System Service Discovery | ## Palo Alto Networks Protection and Mitigation Palo Alto Networks customers are better protected from the threats discussed above through the following products: * The [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the IoCs shared in this research. * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) are designed to: * Prevent the execution of known malicious malware, and also prevent the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module. If you think you might have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Indicators of Compromise SHA256 hash for the malicious PDF file: * bf3b43f5e4398ac810f005200519e096349b2237587d920d3c9b83525bb6bafc SHA256 hash for the downloaded RAR archive: * 9940de30f3930cf0d0e9e9c8769148594240d11242fcd6c9dd9e9f572f68ac01 SHA256 hash of AutoIt-compiled EXE for DarkCloud Stealer: * 30738450f69c3de74971368192a4a647e4ed9c658f076459e42683b110baf371 * 1269c968258999930b573682699fe72de72d96401e3beb314ae91baf0e0e49e8 URL hosting malicious RAR archive: * hxxps\[:\]//files.catbox\[.\]moe/olyfi3.001 ## Additional Resources * [Decoding the Inner Workings of DarkCloud Stealer](https://cyble.com/blog/decoding-the-inner-workings-of-darkcloud-stealer) -- Cyble Blog * [Dark Cloud -- a new stealer on the Polish network](https://cert-orange-pl.translate.goog/aktualnosci/dark-cloud-nowy-stealer-w-polskiej-sieci/?_x_tr_sl=pl&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp) -- CERT Orange Poland Back to top ### Tags * [AutoIT](https://unit42.paloaltonetworks.com/tag/autoit/ "AutoIT") * [Infostealer](https://unit42.paloaltonetworks.com/tag/infostealer/ "Infostealer") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources](https://unit42.paloaltonetworks.com/malicious-payloads-as-bitmap-resources-hide-net-malware/ "Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources") ### Table of Contents * ### Related Articles * [OpenClaw's Skill Marketplace and the Emerging AI Supply Chain Threat](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/ "article - table of contents") * [That AI Extension Helping You Write Emails? It's Reading Them First](https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/ "article - table of contents") * [Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure](https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)