[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# Stealers on the Rise: A Closer Look at a Growing macOS Threat

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 8 min read  
Related Products  
[![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Tom Fakterman](https://unit42.paloaltonetworks.com/author/tom-fakterman/)
  * [Chen Erlich](https://unit42.paloaltonetworks.com/author/chen-erlich/)
  * [Tom Sharon](https://unit42.paloaltonetworks.com/author/tom-sharon/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:February 4, 2025

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Infostealer](https://unit42.paloaltonetworks.com/tag/infostealer/)
  * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/)
  * [Malvertising](https://unit42.paloaltonetworks.com/tag/malvertising/)
  * [Telegram](https://unit42.paloaltonetworks.com/tag/telegram/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/macos-stealers-growing/?pdf=download&lg=en&_wpnonce=f6e4b1f2e6 "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/macos-stealers-growing/?pdf=print&lg=en&_wpnonce=f6e4b1f2e6 "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Stealers%20on%20the%20Rise:%20A%20Closer%20Look%20at%20a%20Growing%20macOS%20Threat&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-stealers-growing%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-stealers-growing%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-stealers-growing%2F&title=Stealers%20on%20the%20Rise:%20A%20Closer%20Look%20at%20a%20Growing%20macOS%20Threat "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-stealers-growing%2F&text=Stealers%20on%20the%20Rise:%20A%20Closer%20Look%20at%20a%20Growing%20macOS%20Threat "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-stealers-growing%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Stealers%20on%20the%20Rise:%20A%20Closer%20Look%20at%20a%20Growing%20macOS%20Threat%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmacos-stealers-growing%2F "Share in Mastodon")

## **Executive Summary**

We recently identified a growing number of attacks targeting macOS users across multiple regions and industries. Our research has identified three particularly prevalent macOS infostealers in the wild, which we will explore in depth: Poseidon, Atomic and Cthulhu. We'll show how they operate and how we detect their malicious activity.

Infostealers can sometimes be viewed as a less worrisome type of threat due to their more limited functionality compared to, for example, remote access Trojans. But by exfiltrating sensitive credentials, financial records and intellectual property, infostealers often lead to data breaches, financial losses and reputational damage. These are all things organizations need to take seriously. [A recent analysis](https://objective-see.org/blog/blog_0x7D.html) of these attacks shows that infostealers account for the largest group of new macOS malware in 2024. In our own telemetry, we detected a 101% increase of macOS infostealers between the last two quarters of 2024.

Palo Alto Networks customers are better protected against the infostealers presented in this research through [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM), and [Cloud-Delivered Security Services](https://docs.paloaltonetworks.com/cdss) for our [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw), such as [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire), [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) and [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering).

If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html).

| **Related Unit 42 Topics** | [**macOS**](https://unit42.paloaltonetworks.com/tag/macos/), **[Infostealers](https://unit42.paloaltonetworks.com/tag/infostealer/)** |
|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------|

## **macOS Infostealers Surge**

Infostealers are a type of malware that is primarily designed to steal a wide range of sensitive information. This information ranges from financial details to the credentials of various services to sensitive files stored on the compromised hosts. Financial details can include payment card details, banking information and crypto wallets.

Most infostealers are indiscriminate, aiming to maximize data collection for impact and monetization. This broad range of information stealing capabilities exposes organizations to significant risks, including data leaks and providing initial access for further attacks, such as ransomware deployment.

Infostealers leveraging macOS often exploit the native [AppleScript](https://developer.apple.com/library/archive/documentation/AppleScript/Conceptual/AppleScriptLangGuide/introduction/ASLR_intro.html) framework. This framework provides extensive OS access, and it also simplifies execution with its natural language syntax. Since these prompts can look like legitimate system prompts, threat actors use this framework to trick victims via social engineering. For example, they can prompt them to enter credentials or trick them into disabling security controls.

Our research, using Cortex XDR telemetry from macOS environments, identified three particularly prevalent infostealers: Atomic Stealer, Poseidon Stealer and Cthulhu Stealer.

This article focuses on these stealers, their interaction with the macOS operating system, and how our products detect their tactics, techniques and procedures (TTPs).

### Atomic Stealer (AMOS)

Also known as AMOS, Atomic Stealer was [discovered in April 2023](https://www.sentinelone.com/blog/atomic-stealer-threat-actor-spawns-second-variant-of-macos-malware-sold-on-telegram/). The developers of Atomic Stealer sell it as malware as a service (MaaS) in hacker forums and on Telegram.

The threat intelligence community has observed several different versions of this infostealer. Earlier versions were written in Go, and the more recent versions are written in C++. Some versions of Atomic Stealer [drop a Python script](https://www.bitdefender.com/en-us/blog/labs/when-stealers-converge-new-variant-of-atomic-stealer-in-the-wild), and other versions use [Mach-O binaries](https://www.sentinelone.com/blog/from-amos-to-poseidon-a-soc-teams-guide-to-detecting-macos-atomic-stealers-2024/).

The Atomic Stealer operators usually distribute their malware via ​​malvertising. It is capable of stealing the following information:

* Notes and documents
* Browser data (e.g., passwords, cookies and more)
* Cryptocurrency wallets
* Instant messaging data (e.g., Discord, Telegram)

Figure 1 shows the execution flow of Atomic Stealer, during one of its operations disguised as a legitimate installation file. This threat attempted to access the file at /Users/$USER$/Library/Application Support/Google/Chrome/Default/Login Data, which stores Google Chrome login credentials.
![Cortex XDR screenshot describing the detection of an unusual process accessing web browser credentials with steps involving system processes and command lines, linked to a security alert message about the potential breach.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-37985-138244-1.png) Figure 1. Execution of Atomic Stealer shown in Cortex XDR.

### Poseidon Stealer

Someone using the alias "Rodrigo4" has advertised Poseidon Stealer in hacker forums, as shown in Figure 2. Rodrigo4 is allegedly a former coder for Atomic Stealer, and Poseidon Stealer is considered a fork or direct competitor of Atomic Stealer.
![Screenshot of a messaging application interface, featuring a conversation advertising the infostealer.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-41991-138244-2.png) Figure 2. Poseidon Stealer advertised by "Rodrigo4."

By August 2024, Rodrigo4 [sold the Poseidon Stealer MaaS](https://x.com/g0njxa/status/1822674267437248696) to an unknown source. However, the malware has apparently remained [active since then](https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software).

Poseidon Stealer infects machines via the download of Trojanized installers pretending to be legitimate applications. Its operators usually distribute it via Google ads and malicious spam emails.

The malicious installer contains an encoded AppleScript file. During the installation process, the malicious installer decodes and executes the AppleScript.

Figure 3 shows an example of a Trojanized application installer in a macOS environment that will install Poseidon Stealer.
![Screenshot of an installation guide dialog box for macOS software, displaying instructions: "1 STEP RIGHT CLICK" and "2 STEP CLICK OPEN" with accompanying icons, set against a vibrant gradient background. Below the dialog is a DMG file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-45860-138244-3.png) Figure 3. Example of a malicious installer that delivers Poseidon Stealer.

After the victim tries to install the application, Poseidon Stealer prompts them with a dialog box to get their password, as shown in Figure 4.
![Pop-up window titled "Application wants to install helper" with a warning icon, requesting to enter a password to continue, featuring a password field and a "Continue" button.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-52040-138244-4.png) Figure 4. Poseidon Stealer prompts the victim with a dialog box in an attempt to get the password.

Poseidon Stealer sends its stolen information to a web server controlled by the attackers. Figure 5 shows the login page of the Poseidon Stealer control panel from one of these web servers.
![Logo of Poseidon infostealer with a login interface, including fields for username and password and a sign-in button, set against a dark background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-54997-138244-5.png) Figure 5. Example of a Poseidon Stealer control panel login page.

Poseidon Stealer executes the main logic of the malware through malicious AppleScript. Figure 6 shows the execution of Poseidon Stealer as detected by Cortex XDR.
![Cortex XDR screenshot of a Mac computer's security alert indicating unusual access to a database Notes.sqlite DB file by the process 'XPC'. The detailed log highlights file path and security settings.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-57744-138244-6.png) Figure 6. Execution of the Poseidon Stealer AppleScript shown in Cortex XDR.

Poseidon Stealer uses the AppleScript to perform the following activities:

* Gathering system information
* Stealing browser passwords and cookies
* Stealing cryptocurrency wallets
* Gathering user credentials and notes from the macOS Notes application
* Collecting Telegram data
* Harvesting passwords from BitWarden and KeePassXC password managers

### Cthulhu Stealer

Cthulhu Stealer is another popular infostealer sold as MaaS via Telegram, by operators who call themselves "Cthulhu Team." Cthulhu Stealer is written in Go and its operators propagate it via malicious application installers. An example of one of these installers is shown in Figure 7.
![Graphic showing a two-step installation process for CleanMyMac. Step 1: Right-click on the CleanMyMac icon. Step 2: Click 'Open'.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-61836-138244-7.png) Figure 7. Malicious "CleanMyMac" application installer that delivers Cthulhu Stealer.

When executed, the malicious installer presents a fake dialog box claiming an update is needed for the system setting and asks for a password. Next, a second dialog box pops up, this time requesting a [MetaMask](https://en.wikipedia.org/wiki/MetaMask) password as shown in Figure 8.
![Two user interface prompts on a computer screen. The top prompt titled "System Preferences" requests a password update for system settings, with options to cancel or confirm. The bottom prompt shows "Wallet Connect" with cancel and confirm options.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-66756-138244-8.png) Figure 8. Cthulhu Stealer fake dialog boxes attempt to steal login credentials.

Cthulhu Stealer targets a broad range of information from a compromised macOS endpoint. This information includes:

* Sensitive data (e.g., passwords, credit cards information, history, cookies) from major browsers:
  * Google Chrome
  * Microsoft Edge
  * Firefox
* A variety of different cryptocurrency wallets
* FileZilla configuration files (which may include usernames and passwords)
* Telegram data
* Note files from the macOS Notes application
* Keychain and SafeStorage Passwords
* Files with the following extensions:
  * .png
  * .jpg
  * .jpeg
  * .icns
  * .doc
  * .xls
  * .xlsx
  * .rtf
  * .pdf
* Data related to the gaming platform Battle\[.\]net and the game Minecraft (shown in Figure 9)

![A split-screen image showing two different segments of computer code, displayed in a text editor with syntax highlighting.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-70408-138244-9.png) Figure 9. Left: Cthulhu Stealer snippet of code targeting information about Minecraft. Right: Cthulhu Stealer snippet of code targeting information about Battle\[.\]net. Figure 10 shows the execution of Cthulhu Stealer in Cortex XDR, disguised as a macOS cleaner application. In this image, Cthulhu Stealer executes a command using AppleScript to display a dialog box to the victim and attempts to decode encrypted browser data.

![Screenshot of Cortex XDR showing a flowchart with icons and text describing a cybersecurity scenario involving CleanMyMac software and a suspicious process accessing a crypto wallet named Exodus. The flow includes system alerts, command line operations, and file path descriptions.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-75001-138244-10.png) Figure 10. Execution of Cthulhu Stealer as shown in Cortex XDR.

Cthulhu Stealer saves the stolen data in a directory at /Users/Shared/NW and uploads it to a command-and-control server. Figure 11 shows the different file names this threat stores data in.
![Cortex XDR table showing a list of file write actions, including paths for Metamask passwords, Keychain, cookies, tokens, and autofills.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-79859-138244-11.png) Figure 11. File locations for data stolen by Cthulhu Stealer shown in Cortex XDR.

## **Conclusion**

This article reviews three prominent macOS infostealer threats, Atomic Stealer, Posedion Stealer and Cthulhu Stealer. These threats are significant not only for what they can steal directly but also because they can represent an entry point for additional malicious activity. For example, a breach that deploys an infostealer may lead to ransomware deployment later.

Implementing advanced macOS detection modules is a step forward in identifying and countering these threats.

Given the pace at which attackers are evolving their methods, a proactive and multi-layered defense strategy is essential for any organization aiming to protect its assets.

## **Protections and Mitigations**

The new [Cortex XDR macOS Analytics suites](https://www.paloaltonetworks.com/blog/security-operations/new-cortex-detectors-for-macos-address-stealers-and-malicious-applescript/) include the following detection suites:

1. **Credentials grabbing analytics**: detecting techniques infostealers use to acquire sensitive credentials
2. **Sensitive information stealing analytics**: detecting techniques infostealers use to steal sensitive information
3. **AppleScript analytics**: detecting malicious ways threat actors use AppleScript

These suites monitor sensitive file access and unusual AppleScript executions, and they have helped us identify malicious activities associated with threat actors trying to steal sensitive information from organizational macOS endpoints.

Additionally:

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) are designed to:
  * Prevent the execution of known malicious malware and also prevent the execution of unknown malware using [Behavioral Threat Protection](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) and machine learning based on the Local Analysis module.
  * Protect against credential gathering tools and techniques using Cortex Credential Gathering Protection.
  * Detect infostealer threats by analyzing anomalous file access, AppleScript execution and user activity from multiple data sources.
* [Advanced WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) cloud-delivered malware analysis service accurately identifies the Poseidon Stealer, Atomic Stealer and Cthulhu Stealer samples mentioned in this article as malicious.
* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/dns-security) identify domains associated with this malware as malicious.

If you think you may have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:

* North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
* UK: +44.20.3743.3660
* Europe and Middle East: +31.20.299.3130
* Asia: +65.6983.8730
* Japan: +81.50.1790.0200
* Australia: +61.2.4062.7950
* India: 00080005045107

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org).

## **Indicators of Compromise**

### SHA256 Hashes for Examples of Atomic Stealer

* 599e6358503a0569d998f09ccfbdeaa629d8910f410e26df0ffbd68112e77b05
* a33705df80d2a7c2deeb192c3de9e7f06c7bfd14b84f782cf86099c52a8b0178
* cfa8173e681bf6866e06b1a971dab03954b28d3626d96ac0827c5f261e7997cd
* 831f80f6e6f7be8352aba0b54b3e55ade63f8719c7e6f8cfa19ee34af5a07deb
* a9fe32498f6132b9c39ae16524bdb3d71b451017a2d3acf117416a0dc9a89ce5
* 3eac9c66a712f74d9e93e24751220a74b2c7e5320c74f1f7b4931d8181c7f26c

### IP Addresses for Atomic Stealer C2 Servers

* 94\.142.138\[.\]177
* 194\.169.175\[.\]117

### SHA256 Hashes for Examples of Poseidon Stealer

* 9f4f286e5e40b252512540cc186727abfb0ad15a76f91855b1e72efb006b854c
* 5880430d86d092ac56bfa4aec7e245e3d9084e996165d64549ccb66b626d8c56
* 0bb4ba056d64fff21d13b53b5c1bd5ccb89bed27e66e2b7ff60ddcf47c1342b4
* 1b9b929e63be771393b6a4e526930eedb78f279174711bd2f19dfa8545f6e714
* c4e7320945caf9dc4dca11f6ad0170bc6fc2148de0cdc8aa15a236b248165d39
* a8aa1d7f940f0a8ccd516e52232b103d343826e13df9e4d9567f75e996683886
* 09852c1f67939efad0f0baeead5d23dc9cd53eec0f1f6069f041dfd4e0e83c3f
* b94067535123dd236a075d54afa34fef80324f7d1375f55c29ca70393e6492b2
* 9390108ca021b5f5c8c25849c1d6903c8a30568e822ce22e01e96381ea2df3b5

### IP Addresses for Poseidon Stealer C2 Servers

* 194\.59.183\[.\]241
* 70\.34.213\[.\]27

### SHA256 Hashes for Examples of Cthulhu Stealer

* 2d232bd6a6b6140a06b3cf59343e3e2113235adcf3fb93e78fa3746d9679cfc3
* d8d29c2906145771e1c12d6520a826c238d5672f256779326ba38859dfb9cf4c
* 6483094f7784c424891644a85d5535688c8969666e16a194d397dc66779b0b12
* a772451ddd6897c00ce766949fc82e30cfb64a6b31b44bfd9068a76ab99dd188
* ad32e638216b859855f78a856f8f4e3aea66add550619a4bde08754e2c218186
* dd831c4aaaceb9f063642ae729956a716e29e0c5452526996e92959cca820914
* 57ece6ae15a8d16a24bad097b4455dc6aec4a24c139d62d05c59330620c3e90e
* 93f33e76c57240dda2b80b0270ad867a4c77ee7ad4ac135d086398e789e4dbc9

### IP Address for Cthulhu Stealer C2 Server

* 89\.208.103\[.\]185

## Additional Resources

* [New Cortex Detectors for macOS Address Stealers and Malicious AppleScript](https://www.paloaltonetworks.com/blog/security-operations/new-cortex-detectors-for-macos-address-stealers-and-malicious-applescript/) -- Cortex Blog, Palo Alto Networks

*Updated Feb. 4, 2025, at 8:55 a.m. PT to add Additional Resources section*
Back to top

### Tags

* [Infostealer](https://unit42.paloaltonetworks.com/tag/infostealer/ "Infostealer")
* [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS")
* [Malvertising](https://unit42.paloaltonetworks.com/tag/malvertising/ "malvertising")
* [Telegram](https://unit42.paloaltonetworks.com/tag/telegram/ "Telegram")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Recent Jailbreaks Demonstrate Emerging Threat to DeepSeek](https://unit42.paloaltonetworks.com/jailbreaking-deepseek-three-techniques/ "Recent Jailbreaks Demonstrate Emerging Threat to DeepSeek")

### Table of Contents

* 

### Related Articles

* [The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "article - table of contents")
* [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ "article - table of contents")
* [Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector](https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")  
  ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")  
  ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/)

* [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API")

* [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway")

* [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)