[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/ "Threat Actor Groups") * [Business Email Compromise](https://unit42.paloaltonetworks.com/category/business-email-compromise/ "Business Email Compromise") [Business Email Compromise](https://unit42.paloaltonetworks.com/category/business-email-compromise/) # Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 7 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Code to Cloud Platform icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Code to Cloud Platform](https://unit42.paloaltonetworks.com/product-category/code-to-cloud-platform/ "Code to Cloud Platform")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Prisma Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud](https://unit42.paloaltonetworks.com/product-category/prisma-cloud/ "Prisma Cloud")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Unit 42](https://unit42.paloaltonetworks.com/author/unit42/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:November 14, 2024 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Business Email Compromise](https://unit42.paloaltonetworks.com/category/business-email-compromise/) * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [BeaverTail](https://unit42.paloaltonetworks.com/tag/beavertail/) * [CL-STA-0237](https://unit42.paloaltonetworks.com/tag/cl-sta-0237/) * [Contagious Interview](https://unit42.paloaltonetworks.com/tag/contagious-interview/) * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/) * [Fake IT Worker](https://unit42.paloaltonetworks.com/tag/fake-it-worker/) * [InvisibleFerret](https://unit42.paloaltonetworks.com/tag/invisibleferret/) * [Lazarus](https://unit42.paloaltonetworks.com/tag/lazarus/) * [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/) * [Remote Access Trojan](https://unit42.paloaltonetworks.com/tag/remote-access-trojan/) * [Supply chain](https://unit42.paloaltonetworks.com/tag/supply-chain/) * [Wagemole](https://unit42.paloaltonetworks.com/tag/wagemole/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/?pdf=download&lg=en&_wpnonce=edee969a51 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/?pdf=print&lg=en&_wpnonce=edee969a51 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Fake%20North%20Korean%20IT%20Worker%20Linked%20to%20BeaverTail%20Video%20Conference%20App%20Phishing%20Attack&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ffake-north-korean-it-worker-activity-cluster%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffake-north-korean-it-worker-activity-cluster%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffake-north-korean-it-worker-activity-cluster%2F&title=Fake%20North%20Korean%20IT%20Worker%20Linked%20to%20BeaverTail%20Video%20Conference%20App%20Phishing%20Attack "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffake-north-korean-it-worker-activity-cluster%2F&text=Fake%20North%20Korean%20IT%20Worker%20Linked%20to%20BeaverTail%20Video%20Conference%20App%20Phishing%20Attack "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffake-north-korean-it-worker-activity-cluster%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Fake%20North%20Korean%20IT%20Worker%20Linked%20to%20BeaverTail%20Video%20Conference%20App%20Phishing%20Attack%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ffake-north-korean-it-worker-activity-cluster%2F "Share in Mastodon") ## Executive Summary Unit 42 researchers identified a North Korean IT worker activity cluster that we track as CL-STA-0237. This cluster was involved in recent phishing attacks using malware-infected video conference apps. It likely operates from Laos, using Lao IP addresses and identities. [CL-STA-0237](https://unit42.paloaltonetworks.com/from-activity-to-formal-naming/) exploited a U.S.-based, small-and-medium-sized business (SMB) IT services company to apply for other jobs. In 2022, CL-STA-0237 secured a position at a major tech company. We believe CL-STA-0237 is another cluster of a broader network of North Korean IT workers supporting the nation's illicit activities, including weapons of mass destruction (WMD) and ballistic missile programs. This article highlights the IT workers' shift from stable income-seeking activities to involvement in more aggressive malware campaigns. Additionally, the article illustrates the global reach of North Korean IT workers. To address these risks, organizations should perform the following activities: * Strengthening their hiring screening processes * Implementing robust monitoring to identify insider threats * Thoroughly evaluating outsourced services * Ensuring that employees do not use corporate machines for personal activities Palo Alto Networks customers receive better protection from malware discussed in this article through [Cortex XDR](https://www.paloaltonetworks.com/resources/datasheets/cortex-xdr) and [XSIAM](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsiam-aag) and [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud). [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) identify known URLs and domains associated with this activity as malicious. If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**North Korea**](https://unit42.paloaltonetworks.com/tag/north-korea/), **[BeaverTail](https://unit42.paloaltonetworks.com/tag/beavertail/)** | |----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------| ## Updated Contagious Interview Campaign Tactics In a [previous article](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/), we covered the Contagious Interview campaign where North Korean threat actors posed as fake employers reaching out to IT developers with fictitious job offers and conducted technical interviews. During these interviews, attackers delivered [npm](https://en.wikipedia.org/wiki/Npm) (a package manager for the JavaScript programming language) projects with malicious content, which led to BeaverTail malware infections. Attackers then deployed InvisibleFerret malware, which includes additional remote access Trojan (RAT) features. In addition to the recently published reports from [The Object-See Foundation](https://objective-see.org/blog/blog_0x7A.html) and [GROUP-IB](https://www.group-ib.com/blog/apt-lazarus-python-scripts/) on the Contagious Interview campaign's updated TTPs, [Unit 42 has released a new report](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/) that highlights the latest developments surrounding the BeaverTail malware. These reports delve into how threat actors set up fake video conferencing websites imitating [MiroTalk](https://meet.no42.org/) and [FreeConference](https://www.freeconference.com/). Attackers lured targets into downloading conference call installers embedded with BeaverTail malware. This new approach differs from previous tactics in that malware delivery occurs at the start of the job interview, using installer packages. This method allows attackers to target a broader range of job seekers, rather than only those with npm JavaScript development expertise and specific machine configurations. Our investigation into this updated campaign led to the identification of the fake North Korean IT worker cluster we are focusing on in this research. This is the second instance where we have observed connections between the Contagious Interview malware campaign and North Korean IT worker activities, also known as the [Wagemole](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/) campaign. In the Wagemole campaign, North Korean IT workers pose as job seekers, often freelance developers, and they seek remote IT jobs using stolen identities. ## Fake North Korean IT Worker CL-STA-0237 Linked to the Phishing Attack Our internal telemetry identified newly registered domains resolving to a known IP address, 167.88.36\[.\]13, which is associated with the MiroTalk fake job campaign from July 2024 discussed above. Further investigation revealed that the CL-STA-0237 activity cluster, which registered these domains, used information from a U.S.-based SMB IT services company. CL-STA-0237 not only exploited the company's information but also controlled multiple IT infrastructure and management accounts that belonged to the company. CL-STA-0237 listed the company as its employer, citing employment since 2019 in some of its fake resumes. It also managed email accounts that mimicked the company's owner, using them to apply for other jobs. We could not fully verify the connections between CL-STA-0237 and the exploited company. Our hypothesis suggests two potential scenarios: * CL-STA-0237 stole the company's access credentials and is now posing as the company to secure new IT jobs or target job seekers with malware infections. * CL-STA-0237 was either hired by or had an outsourcing partnership with the IT services company, which allowed it to gain access to the company's infrastructure. ## Fake Resumes Created by the Actor In the Wagemole campaign, North Korean IT workers commonly managed multiple personas using fake or stolen identities from around the world. Figure 1 shows fake resumes created by CL-STA-0237. ![Multiple images on display including a close-up of a individual with some of their features blurred, as well as smaller images depicting a professional setting, and a map marking a shopping mall in Vientiane, Laos. The arrows walk the reader through how this person's location was traced.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-946362-137474-1.png) Figure 1. Fake resumes created by CL-STA-0237. Although the headshot photos differ slightly, they appear to be different pictures of the same individual. With moderate confidence, we believe these headshots belong to a real member of CL-STA-0237, as they are likely required to show their face during video conference calls with employers or clients. ## Possible Physical Presence in Laos Tracing CL-STA-0237's activities revealed the use of multiple Lao residential IP addresses. Criminals commonly use residential proxy services, so the use of such IP addresses alone does not provide strong evidence of physical presence. However, we were able to verify that one of the threat actor's headshot photos in Figure 2 was taken at a shopping mall in Vientiane, Laos, between late 2020 and mid-2021. ![Screenshot collage showing multiple user profiles from a professional networking platform, including sections on work experience, education, skills, and personal endorsements. Much of the information is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-950772-137474-2.png) Figure 2. Tracing the geolocation and timeframe of CL-STA-0237. The A and B sections of the background of the IT worker's headshot photo in Figure 2 strongly indicated that it was taken in a shopping mall. Additionally, an advertisement for a phone model released in late 2020 suggested the time frame in which the picture was taken. Considering these factors, along with [Laos being one of the countries where North Korean IT workers have been dispatched](https://home.treasury.gov/news/press-releases/jy1498), it is plausible that CL-STA-0237 may have had a physical presence in Laos. In contrast, previous Wagemole campaign clusters were primarily linked to IP infrastructures based in China and Russia. ## Securing a Job at a Major Tech Company The intelligence we gathered on CL-STA-0237 suggests that it secured multiple short-term and long-term jobs from companies of various sizes. We believe, with moderate confidence, that CL-STA-0237 secured a position in at least one major tech company in 2022. CL-STA-0237 had access to the company's single sign-on (SSO) system, with an account created under the company's domain. We believe this account was created for the North Korean IT worker rather than stolen, as the username corresponds to one of the fake identities CL-STA-0237 has been using in its fake IT worker operation. ## Attribution Since our previous report on the two job-related campaigns, some researchers have begun attributing the Contagious Interview campaign to the well-known North Korean threat group, Lazarus. However, we are not certain whether the IT workers led the attacks or simply assisted other hacking groups. Despite this uncertainty, we continue to observe links between malware campaigns and North Korean IT workers, thus we track these activities under our temporary cluster names. On the other hand, there have been new developments regarding the attribution of the Wagemole campaign. Ethereum wallets associated with one of the Wagemole clusters showed significant fund transfers to a wallet belonging to Sang Man Kim. Kim is a North Korean individual sanctioned by the U.S. Treasury for his role in supporting North Korea's [illicit activities](https://home.treasury.gov/news/press-releases/jy1498), including its WMD and ballistic missile programs. Kim is specifically linked to managing the finances of overseas North Korean IT workers in Russia and Laos, providing a potential connection to the campaign's financial operations. ## Conclusion North Korean threat actors have been highly successful in generating revenue to fund their nation's illicit activities. They began by posing as fake IT workers to secure consistent income streams, but they have begun transitioning into more aggressive roles, including participating in insider threats and malware attacks. The continuous discovery of such operations highlights the vast scale of the threat. Despite numerous reports, media coverage and law enforcement efforts, these campaigns have not diminished. We anticipate that North Korean job-related campaigns will likely persist and even escalate. To mitigate these risks, organizations must [enhance their screening processes](https://unit42.paloaltonetworks.com/north-korean-it-workers/) for new hires. This includes the following activities: * Bolstering monitoring to detect insider threats * Carefully vetting outsourced services * Ensuring that employees do not use corporate machines for personal activities Palo Alto Networks customers are better protected from the threats discussed above through the following products: * [Cortex XDR](https://www.paloaltonetworks.com/resources/datasheets/cortex-xdr) and [XSIAM](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsiam-aag) customers, users of both cloud and on-premises agents, receive protections out-of-the-box. Cortex's XSIAM AI-assisted operations centralize data and SOC detection and response capabilities, providing protections from the advanced threats described in this article. * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) customers are protected out-of-the-box should the infection chains discussed within this article expose cloud infrastructure. Prisma Cloud monitors CI/CD pipelines, Cloud Secret Managers, Infrastructure as Code (IaC) templates and Software Composition to ensure that malicious execution, creation, modification or deletion of cloud resources are detected and remediated. * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) identify known URLs and domains associated with this activity as malicious If you think you may have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Indicators of Compromise ### **Domains** * effertz-carroll\[.\]com * regioncheck\[.\]net * freeconference\[.\]io * ipcheck\[.\]cloud * mirotalk\[.\]io * mirotalk\[.\]net * ftpserver0909\[.\]com ### **IP Address** * 167\.88.36\[.\]13 ### **Email Addresses** * adonis\_eros@outlook\[.\]com * brightstar1116@outlook\[.\]com * buyerlao@outlook\[.\]com * casey\_qadir@outlook\[.\]com * cescernand@outlook\[.\]com * devstar1116@gmail\[.\]com * ebcappservices@gmail\[.\]com * hakajakin@outlook\[.\]com * ideationbrand@gmail\[.\]com * legend\_dev@outlook\[.\]com * liko.sonexarth@gmail\[.\]com * liko.sonexarth@hotmail\[.\]com * longines0924@gmail\[.\]com * lujindane@outlook\[.\]com * matthewhall14541@gmail\[.\]com * niko.sonexarth@gmail\[.\]com * niko.sonexarth@hotmail\[.\]com * oscar.vetres127@europe\[.\]com * oscar.vetres127@gmail\[.\]com * pinefirst@outlook\[.\]com * reply9998@gmail\[.\]com * richard.stewart.1202@gmail\[.\]com * richard.stewart.1202@outlook\[.\]com * sniper\_bruce@outlook\[.\]com * stp.walsh33@gmail\[.\]com * techcare127@gmail\[.\]com * truepai415@gmail\[.\]com * truestar222@outlook\[.\]com * volodimir.work2020@gmail\[.\]com * zhangming\_k@yahoo\[.\]com * zhuming1116@gmail\[.\]com * lisettekolson8@gmail\[.\]com * 312011217@qq\[.\]com * alhinglovena3000@gmail\[.\]com * jumphon2103@gmail\[.\]com * mobilephetjum@gmail\[.\]com * phetchamphone1998@gmail\[.\]com ## Additional Resources * [Global Companies Are Unknowingly Paying North Koreans: Here's How to Catch Them](https://unit42.paloaltonetworks.com/north-korean-it-workers/) -- Unit 42, Palo Alto Networks * [Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/) -- Unit 42, Palo Alto Networks * [Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/) -- Unit 42, Palo Alto Networks * [This Meeting Should Have Been an Email - A DPRK stealer, dubbed BeaverTail, targets users via a trojanized meeting app](https://objective-see.org/blog/blog_0x7A.html) -- Objective-See Foundation * [APT Lazarus: Eager Crypto Beavers, Video calls and Games](https://www.group-ib.com/blog/apt-lazarus-python-scripts/) -- GROUP-IB * [Treasury Targets DPRK Malicious Cyber and Illicit IT Worker Activities](https://home.treasury.gov/news/press-releases/jy1498) -- Press release, U.S. Department of the Treasury Back to top ### Tags * [BeaverTail](https://unit42.paloaltonetworks.com/tag/beavertail/ "BeaverTail") * [CL-STA-0237](https://unit42.paloaltonetworks.com/tag/cl-sta-0237/ "CL-STA-0237") * [Contagious Interview](https://unit42.paloaltonetworks.com/tag/contagious-interview/ "Contagious Interview") * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/ "DPRK") * [Fake IT Worker](https://unit42.paloaltonetworks.com/tag/fake-it-worker/ "Fake IT Worker") * [InvisibleFerret](https://unit42.paloaltonetworks.com/tag/invisibleferret/ "InvisibleFerret") * [Lazarus](https://unit42.paloaltonetworks.com/tag/lazarus/ "Lazarus") * [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/ "North Korea") * [Remote Access Trojan](https://unit42.paloaltonetworks.com/tag/remote-access-trojan/ "Remote Access Trojan") * [Supply chain](https://unit42.paloaltonetworks.com/tag/supply-chain/ "supply chain") * [Wagemole](https://unit42.paloaltonetworks.com/tag/wagemole/ "Wagemole") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Global Companies Are Unknowingly Paying North Koreans: Here's How to Catch Them](https://unit42.paloaltonetworks.com/north-korean-it-workers/ "Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them") ### Table of Contents * ### Related Articles * [Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "article - table of contents") * [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain](https://unit42.paloaltonetworks.com/sdlc-supply-chain/ "article - table of contents") * [The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)](https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/ "article - table of contents") ## Related Business Email Compromise Resources ![Pictorial representation of a group of individuals discussing an idea with a whiteboard.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/02_Listicle_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) February 3, 2026 [#### Why Smart People Fall For Phishing Attacks](https://unit42.paloaltonetworks.com/psychology-of-phishing/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/psychology-of-phishing/ "Why Smart People Fall For Phishing Attacks") ![Pictorial representation of a IUAM ClickFix generator. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen, indicating malware.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/03_Malware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 8, 2025 [#### The ClickFix Factory: First Exposure of IUAM ClickFix Generator](https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/) * [Bash](https://unit42.paloaltonetworks.com/tag/bash/ "bash") * [ClickFix](https://unit42.paloaltonetworks.com/tag/clickfix/ "ClickFix") * [Phishing Kit](https://unit42.paloaltonetworks.com/tag/phishing-kit/ "Phishing Kit") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/ "The ClickFix Factory: First Exposure of IUAM ClickFix Generator") ![Pictorial representation of phishing bait using AI. A luminous cube labeled "AI" centrally placed on a futuristic circuit board landscape with glowing blue lights and connections.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/03_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 19, 2025 [#### Fashionable Phishing Bait: GenAI on the Hook](https://unit42.paloaltonetworks.com/genai-phishing-bait/) * [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/genai-phishing-bait/ "Fashionable Phishing Bait: GenAI on the Hook") ![Pictorial representation of social engineering. Digital illustration of four human profiles connected by glowing neural network lines against a dark background, symbolizing connectivity and technology.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/cover-1920x900-no-blades-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-report-white-1.svg)Trend Reports](https://unit42.paloaltonetworks.com/category/trend-reports/) July 30, 2025 [#### 2025 Unit 42 Global Incident Response Report: Social Engineering Edition](https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/) * [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens") * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ClickFix](https://unit42.paloaltonetworks.com/tag/clickfix/ "ClickFix") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/ "2025 Unit 42 Global Incident Response Report: Social Engineering Edition") ![Pictorial representation of homograph attacks. 3D illustration of an open laptop displaying an envelope icon on the screen, accompanied by a smartphone and tablet, all set against a dark background with neon lighting.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/01_Business_email_compromise_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 25, 2025 [#### The Ηоmоgraph Illusion: Not Everything Is As It Seems](https://unit42.paloaltonetworks.com/homograph-attacks/) * [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/homograph-attacks/ "The Ηоmоgraph Illusion: Not Everything Is As It Seems") ![Pictorial representation of the ransomware landscape. Digital artwork of a disintegrating U.S. dollar bill with pixelated effects on a cyber-inspired background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/05_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-report-white-1.svg)Trend Reports](https://unit42.paloaltonetworks.com/category/trend-reports/) April 23, 2025 [#### Extortion and Ransomware Trends January-March 2025](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/) * [BianLian](https://unit42.paloaltonetworks.com/tag/bianlian/ "BianLian") * [Akira ransomware](https://unit42.paloaltonetworks.com/tag/akira-ransomware/ "Akira ransomware") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/ "Extortion and Ransomware Trends January-March 2025") ![Pictorial representation of a QR code phishing campaign. Digital artwork of a futuristic, glowing shield disintegrating into small particles, set against a dark blue, speckled background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/09_Business_email_compromise_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 1, 2025 [#### Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon](https://unit42.paloaltonetworks.com/qr-code-phishing/) * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/ "social engineering") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/qr-code-phishing/ "Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon") ![An Asian woman examining data on multiple computer screens in a high-tech digital environment, surrounded by visual representations of data and code. Lens flare is prominent across the image.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/07_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) February 28, 2025 [#### JavaGhost's Persistent Phishing Attacks From the Cloud](https://unit42.paloaltonetworks.com/javaghost-cloud-phishing/) * [AWS](https://unit42.paloaltonetworks.com/tag/aws/ "AWS") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/javaghost-cloud-phishing/ "JavaGhost’s Persistent Phishing Attacks From the Cloud") ![Pictorial representation of a European phishing campaign. A digital artwork depicting a glowing, futuristic shield disintegrating into small fragments against a shimmering blue background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/09_Business_email_compromise_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 18, 2024 [#### Effective Phishing Campaign Targeting European Companies and Organizations](https://unit42.paloaltonetworks.com/european-phishing-campaign/) * [EMEA](https://unit42.paloaltonetworks.com/tag/emea/ "EMEA") * [Manufacturing](https://unit42.paloaltonetworks.com/tag/manufacturing/ "Manufacturing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/european-phishing-campaign/ "Effective Phishing Campaign Targeting European Companies and Organizations") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)