[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Code to Cloud Platform icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Code to Cloud Platform](https://unit42.paloaltonetworks.com/product-category/code-to-cloud-platform/ "Code to Cloud Platform")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Prisma Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud](https://unit42.paloaltonetworks.com/product-category/prisma-cloud/ "Prisma Cloud")[![Prisma Cloud Compute icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud Compute](https://unit42.paloaltonetworks.com/product-category/prisma-cloud-compute/ "Prisma Cloud Compute")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Unit 42](https://unit42.paloaltonetworks.com/author/unit42/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:October 9, 2024 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/) * [BeaverTail](https://unit42.paloaltonetworks.com/tag/beavertail/) * [CL-STA-240](https://unit42.paloaltonetworks.com/tag/cl-sta-240/) * [Contagious Interview](https://unit42.paloaltonetworks.com/tag/contagious-interview/) * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/) * [InvisibleFerret](https://unit42.paloaltonetworks.com/tag/invisibleferret/) * [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/) * [Python](https://unit42.paloaltonetworks.com/tag/python/) * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/?pdf=download&lg=en&_wpnonce=fafa58d2d0 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/?pdf=print&lg=en&_wpnonce=fafa58d2d0 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Contagious%20Interview:%20DPRK%20Threat%20Actors%20Lure%20Tech%20Industry%20Job%20Seekers%20to%20Install%20New%20Variants%20of%20BeaverTail%20and%20InvisibleFerret%20Malware&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters%2F&title=Contagious%20Interview:%20DPRK%20Threat%20Actors%20Lure%20Tech%20Industry%20Job%20Seekers%20to%20Install%20New%20Variants%20of%20BeaverTail%20and%20InvisibleFerret%20Malware "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters%2F&text=Contagious%20Interview:%20DPRK%20Threat%20Actors%20Lure%20Tech%20Industry%20Job%20Seekers%20to%20Install%20New%20Variants%20of%20BeaverTail%20and%20InvisibleFerret%20Malware "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Contagious%20Interview:%20DPRK%20Threat%20Actors%20Lure%20Tech%20Industry%20Job%20Seekers%20to%20Install%20New%20Variants%20of%20BeaverTail%20and%20InvisibleFerret%20Malware%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters%2F "Share in Mastodon") ## **Executive Summary** Unit 42 has tracked activity from threat actors associated with the Democratic People's Republic of Korea (DPRK), where they pose as recruiters to install malware on tech industry job seekers' devices. We call this activity the [CL-STA-240 Contagious Interview campaign](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/), and we first published about it in November 2023. Since that publication, we've observed additional online activity from the fake recruiters, as well as code updates to two pieces of malware associated with the campaign; the BeaverTail downloader and the InvisibleFerret backdoor. The BeaverTail malware associated with this campaign has been compiled using the Qt framework as early as July 2024. We have observed multiple samples of BeaverTail that are compiled for both macOS and Windows platforms. In addition, we observed continuous code updates to the InvisibleFerret backdoor delivered by the BeaverTail downloader. In this article, we will discuss the online activity of fake recruiters and technical details of the campaign, including the following specifics: * Analyzing the macOS, Windows and Python malware * Providing examples of Cortex XDR detecting and preventing this cross-platform threat Palo Alto Networks customers are better protected from the threats discussed in this article through our [Network Security](https://www.paloaltonetworks.com/network-security) solutions, [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) offerings and the [Cortex](https://www.paloaltonetworks.com/cortex) line of products. If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Advanced Persistent Threat (APTs)**](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/), **[North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/)** | |----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ## **Social Engineering and Infection: Fake Recruiters and Job Interviews** As described in [our previous article on Contagious Interview](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/), the threat actor behind CL-STA-0240 contacts software developers through job search platforms by posing as a prospective employer. The attackers invite the victim to participate in an online interview, where the threat actor attempts to convince the victim to download and install malware. Recent reporting and social media activity like [this thread on X (formerly Twitter)](https://x.com/malwrhunterteam/status/1812792291876119034) indicate this activity continues. A [June 2024 Medium article](https://medium.com/coinmonks/fake-recruiters-in-github-68d0d3bf297d) describes a relatively recent example. In this case, a fake recruiter account using the name Onder Kayabasi contacted the writer over LinkedIn. While this LinkedIn account is no longer available, a similar account for Onder Kayabasi remained active on X (formerly known as Twitter) as recently as August 2024. Figure 1 shows the X profile for this user. ![X post by Önder Kayabaşı, a recruiter in the financial services industry, seeking professional blockchain, Web3 and smart contract developers. The post includes Önder Kayabaşı's profile photo and additional details about job requirements and salaries in the field.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-410967-137007-1.png) Figure 1. Profile of "Onder Kayabasi," a fake recruiter on X. Source: [X](https://x.com/onderkayabasi). After the attacker set up a technical interview online, the attacker convinced the potential victim to execute malicious code. [In this case](https://www.linkedin.com/posts/rlwchang_onder-kayabasi-ecoseeds-linkedin-activity-7206406462670057473-aARP/), the potential victim purposefully ran the code in a virtual environment, which eventually connected back to the attacker's command and control (C2) server 95.164.17\[.\]24:1224, as noted below in Figure 2. ![Text image featuring a personal story about coding challenges. It begins with a description of a typical coding issue and evolves into a narrative involving running a VM, encountering coding errors in JavaScript and Python. It includes a weird Google Meet call and the IP address of the traced server.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-417079-137007-2.png) Figure 2. A LinkedIn post describing an attempted malware infection from CL-STA-0240. Source: [LinkedIn](https://www.linkedin.com/posts/rlwchang_onder-kayabasi-ecoseeds-linkedin-activity-7206406462670057473-aARP/). Another social media post noted the same type of activity and IP address on Reddit as noted below in Figure 3. This is the same IP address and TCP port used by the new version of the BeaverTail malware that we analyze [in the next section](#post-137007-_rygkoscar9t3). ![Screenshot of a Reddit discussion thread titled 'Beware of scammers!' in the r/webdev community, advising on the various system details scammers often ask for, such as hostnames, IP address, etc. The post includes user comments with warnings and advice on internet security. Some identifying information has been redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-420442-137007-3.png) Figure 3. A Reddit post describing an attempted malware infection from CL-STA-024. This activity is consistent with [our previous report](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/) on the CL-STA-0240 Contagious Interview campaign. And like previous activity from this campaign, the initial malware is BeaverTail. ## **Analysis of BeaverTail's New Cross-Platform Version** BeaverTail is a downloader and infostealer associated with the CL-STA-0240 campaign, which we [first reported on in 2023](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/). In this campaign the attackers delivered BeaverTail via files masquerading as the following applications: * MiroTalk, a real-time video call application * FreeConference, a service that offers free conference calling Threat actors often abuse, take advantage of or subvert legitimate products for malicious purposes. This does not imply that the legitimate product is flawed or malicious. Similar findings were also detailed in [GROUP-IB's recent research](https://www.group-ib.com/blog/apt-lazarus-python-scripts/). In recent months, the attackers created new versions of the BeaverTail malware. This time instead of coding it in JavaScript like previous versions, they wrote the new version in [Qt](https://wiki.qt.io/About_Qt). Since Qt enables developers to create cross-platform applications, the attackers could use the same source code to compile applications for both Windows and macOS simultaneously. Figure 4 shows the installation process of BeaverTail in both Windows and macOS. ![Two screenshots showing the installation process of the MiroTalk setup wizard. The first image displays the initial screen of the installation wizard, with 'Next,' 'Back,' and 'Cancel' options. The second image shows a context menu on a desktop screen with options like 'Open,' 'Run as administrator,' and others highlighted for the MiroTalk setup wizard. Red arrow point to different elements as the process continues.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-425298-137007-4.jpeg) Figure 4. Left: Fake MiroTalk BeaverTail installation in Windows. Right: Fake MiroTalk BeaverTail installation in macOS. When installing the macOS variant of BeaverTail in the form of a fake MiroTalk package, the victim must mount the MiroTalk.dmg disk image and run the package within that image. For Windows, the respective installation package file is named MiroTalk.msi. Objective-See published an [article in July 2024](https://objective-see.org/blog/blog_0x7A.html) analyzing the macOS version of BeaverTail, describing its main capabilities, such as data exfiltration and execution of additional payloads. After the malicious applications are successfully installed, when the victim opens the applications for the first time, they see a GUI as shown in Figure 5. ![Screenshot displaying two computer application interfaces side by side. On the left, the 'FreeConference' login screen requests an access code for meeting entry. On the right, 'MiroTalk' promotes secure, private communication with a feature to join a room by inputting a username. Red arrows point from the application shortcut on the desktop to the start screens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-428589-137007-5.png) Figure 5. Left: BeaverTail opens a fake login window for FreeConference.com. Right: BeaverTail opens a fake login window for MiroTalk. Meanwhile, BeaverTail executes its malicious code in the background, collecting data and exfiltrating it from the victim's host without any visible indicators. This Qt-based version of BeaverTail has largely the same functionality as the JavaScript-based version we [analyzed in November 2023](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/). Additional features in this new Qt version of BeaverTail include: * Stealing browser passwords in macOS * Stealing cryptocurrency wallets in both macOS and Windows (shown in Figure 6) This last feature is consistent with the ongoing financial interests of North Korean threat actors. ![Image depicting a code editor with lines of colorful code, including variable declarations and function calls, primarily in blues, pinks, and greens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-433950-137007-6.png) Figure 6. A snippet of BeaverTail Qt code stealing cryptocurrency wallets. Additionally, this newer Qt version of BeaverTail targets 13 different cryptocurrency wallet browser extensions, compared to only nine wallets previously targeted by the JavaScript variant. Of the current 13 extensions, the authors added 5 for new wallets, and removed one. Table 1 lists the cryptocurrency wallet browser extensions IDs, names and targeted browsers. |----------------------------------|----------------------------|----------------------| | **Browser Extension ID** | **Browser Extension Name** | **Targeted Browser** | | nkbihfbeogaeaoehlefnkodbefgpgknn | MetaMask Wallet | Chrome | | ejbalbakoplchlghecdalmeeeajnimhm | MetaMask Wallet | Microsoft Edge | | fhbohimaelbohpjbbldcngcnapndodjp | BNB Chain Wallet (Binance) | Chrome | | hnfanknocfeofbddgcijnmhnfnkdnaad | Coinbase Wallet | Chrome | | ibnejdfjmmkpcnlpebklmnkoeoihofec | TronLink Wallet | Chrome | | bfnaelmomeimhlpmgjnjophhpkkoljpa | Phantom Wallet | Chrome | | aeachknmefphepccionboohckonoeemg | Coin98 Wallet | Chrome | | hifafgmccdpekplomjjkcfgodnhcellj | Crypto\[.\]com Wallet | Chrome | | jblndlipeogpafnldhgmapagcccfchpi | Kaikas Wallet | Chrome | | acmacodkjbdgmoleebolmdjonilkdbch | Rabby Wallet | Chrome | | dlcobpjiigpikoobohmabehhmhfoodbb | Argent X - Starknet wallet | Chrome | | aholpfdialjgjfhomihkjbmgjidlcdno | Exodus Web3 Wallet | Chrome | Table 1. Cryptocurrency wallet extension IDs, names and targeted browsers. After exfiltrating collected data to the C2, BeaverTail attempts to download the Python programming language to the infected machine from the URL hxxp://\:1224/pdown. Downloading Python is essential to successfully executing the InvisibleFerret backdoor payload, which is written in Python. This enables InvisibleFerret to be cross platform as well. Figure 7 below shows the code responsible for downloading Python from BeaverTail's C2 server. ![Screenshot of computer code in an editor, highlighting various functions and snippets related to Python and Qt framework.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-437169-137007-7.png) Figure 7. Snippet of BeaverTail Qt code downloading Python. Next, the malware will download the first stage of InvisibleFerret from the URL hxxp://\:1224/client/\, as shown in Figure 8. ![Screenshot of a programming code snippet featuring functions related to file operations, memory allocation, and debug logging. Different syntax is color-coded to make it stand out.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-439898-137007-8.png) Figure 8. Snippet of BeaverTail Qt variant code downloading InvisibleFerret. ## **The Final Python Backdoor Payload: InvisibleFerret** InvisibleFerret is a Python backdoor that we fully analyzed in [our previous article](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/) on the Contagious Interview campaign. InvisibleFerret has multiple components: * **An initial downloader**: Responsible for downloading the other two components listed below * **Main payload component -** Its capabilities include\*\*:\*\* * Fingerprinting the infected endpoint * Remote control of the infected endpoint * Keylogging * Exfiltrating sensitive files * Downloading the AnyDesk client on-demand for additional remote control capabilities * **Browser stealer component**: Enables the attackers to steal browser credentials and credit card information Figure 9 shows the execution flow of InvisibleFerret's components as described in our previous analysis. ![Flowchart explaining the modules of the BeaverTail malware, including initial NPL script, InvisibleFerret payloads, and connections to AnyDesk software. Icons and arrows indicate the process and data flow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-442837-137007-9.png) Figure 9. InvisibleFerret components infographic. Source: [Unit 42](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/). By examining the latest InvisibleFerret versions deployed in this campaign during the past year, we saw slight code changes implemented over time. While its general functionality remains nearly identical, these changes suggest that the malware authors are actively working on the malware's code in between the waves of their attacks. In this section we will examine the code changes between the InvisibleFerret backdoor deployed by the BeaverTail installer that masquerades as MiroTalk and the BeaverTail installer that masquerades as the FreeConference service application. Noticeable code modifications are shown in Table 2. |-------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Command** | **InvisibleFerret Installed by Fake MiroTalk Installer** | **InvisibleFerret Installed by Fake FreeConference Installer** | | ssh\_cmd | Checks if the argument value is equal to delete and if so, closes the session. To notify the C2 server, it sends the message string \[close\]. | Checks the OS type. If the OS type is Windows, it tries to kill python.exe via the taskkill command. If the OS type is not Windows, it tries to kill Python via the killall command | | ssh\_env | Collects content from specific folders (Documents and Downloads for Windows, /home and /Volumes for others), and uploads these files to the attacker's FTP server. | On Windows: Collects .env files from all folders under the following drives: C:\\, D:\\, E\\, F:\\, G:\\ while ignoring folders named node\_modules. Other OSes: Collects .env files from all folders under the home directory (~) while ignoring folders named node\_modules | Table 2. InvisibleFerret code updates. Figure 10 shows a comparison of the ssh\_cmd function code between the different versions of InvisibleFerret. ![Two blocks of code snippets are displayed side by side, showing different invocations for killing a Python process based on the operating system type. The captions indicate that the code on the left might be installed by the MiroTalk Installer, while the code on the right might be installed by the FreeConference.com Installer.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-447159-137007-10.png) Figure 10. ssh\_cmd code comparison between the different versions of InvisibleFerret. Another interesting change was implemented in one of the subcommands of ssh\_upload named ss\_ufind. This subcommand enables the attackers to search for files matching a given pattern. In the older InvisibleFerret version, the attackers first collected the names of all the files and only then did the Python code filter out names by pattern. In the newer version, InvisibleFerret uses the Windows findstr or macOS find commands to search for the files by a specific pattern, thus making the code more efficient. ## **Conclusion** In this article, we present recent activity from the CL-STA-0240 Contagious Interview campaign. In this campaign, the attackers targeted job-seeking individuals on LinkedIn, luring them to download and execute malware that masquerades as a legitimate video call application. This campaign is a continuation of activity we initially [reported in November 2023](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/). The attackers behind this campaign introduced a new Qt version of the BeaverTail malware as early as July 2024. The malware authors compiled BeaverTail variants for both Windows and macOS from the same source code using the Qt programming language. North Korean threat actors are [known to conduct financial crimes](https://www.reuters.com/technology/cybersecurity/north-korea-laundered-1475-mln-stolen-crypto-march-say-un-experts-2024-05-14/) for funds to support the DPRK regime. This campaign may be financially motivated, since the BeaverTail malware has the capability of stealing 13 different cryptocurrency wallets. The infection chain culminates in deploying the InvisibleFerret Python backdoor, which enabled the attackers to maintain control of the machine and exfiltrate sensitive data. We also detailed new features of the InvisibleFerret Python backdoor variant seen in this campaign. Another important risk that this campaign poses is potential infiltration of the companies who employ the targeted job seekers. A successful infection on a company-owned endpoint could result in collection and exfiltration of sensitive information. It is essential for individuals and organizations to be aware of such advanced social engineering campaigns. We encourage the community to leverage our findings to inform the deployment of protective measures to defend against such threats. ### Protections and Mitigations BeaverTail and InvisibleFerret are detected and prevented in Cortex XDR both on macOS and Windows platforms. Figure 11 shows the execution, detection and prevention of the BeaverTail Windows variant and InvisibleFerret as seen in Cortex XDR. ![Diagram in Cortex XDR showing the file structures and command lines for various software components, labeled with entity names including "BeaverTail," "InvisibleFerret," and more. Icons represent file types and commands in a flowchart layout.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-449823-137007-11.png) Figure 11. Cortex XDR alert for BeaverTail and InvisibleFerret execution in Windows. Figure 12 shows the execution, detection and prevention of the BeaverTail macOS version and InvisibleFerret as seen in Cortex XDR. ![Flowchart in Cortex XDR showing software architecture with three main nodes labeled "BeaverTail", and "InvisibleFerret", connected by lines indicating interactions. Each node is linked to smaller sub-nodes detailing specific file paths and programming languages.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-452594-137007-12.png) Figure 12. Cortex XDR alert for BeaverTail and InvisibleFerret execution in macOS. For Palo Alto Networks customers, our products and services provide the following coverage associated with this group: * The [Advanced WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the IoCs shared in this research. * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/dns-security) identify known URLs and domains associated with this activity as malicious. * The [Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall) with the [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention) security subscription can help block the attacks with best practices via the following Threat Prevention signatures: 86817, 86818 and 86819. * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) are designed to: * Prevent the execution of known malicious malware and prevent the execution of unknown malware using [Behavioral Threat Protection](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Endpoint-Protection) as well as machine learning based on the Local Analysis module * Protect against credential gathering tools and techniques using the new Credential Gathering Protection available from Cortex XDR * Protect from threat actors dropping and executing commands from web shells using Anti-Webshell Protection, newly released in Cortex XDR * Protect against exploitation of different vulnerabilities including ProxyShell and ProxyLogon using the Anti-Exploitation modules as well as Behavioral Threat Protection, including credential-based attacks, with behavioral analytics, through [Cortex XDR Pro](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/analytics-alerts-by-required-data-source) * [Prisma Cloud Compute](https://www.paloaltonetworks.com/resources/datasheets/prisma-cloud-compute-edition-aag) and [Advanced WildFire](https://www.paloaltonetworks.com/blog/prisma-cloud/prisma-cloud-and-wildfire-integration/) integration can help detect and prevent malicious execution of the malware within Windows-based VM, container and serverless cloud infrastructure If you think you might have been impacted or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 ## **Indicators of Compromise** BeaverTail Installer - macOS DMG disk image: * 000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923 * 9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c SHA256 hash for BeaverTail - macOS Mach-O executable file: * 0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132 * d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e SHA256 hashes for BeaverTail Installers - Windows MSI files: * 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 * de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170 * fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0 SHA256 hashes for BeaverTail - Windows EXE files: * 0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd * 9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4 * d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6 IP addresses for BeaverTail \& InvisibleFerret C2 servers: * 95\.164.17\[.\]24 * 185\.235.241\[.\]208 SHA256 hashes for InvisibleFerret related components: * 07183a60ebcb02546c53e82d92da3ddcf447d7a1438496c4437ec06b4d9eb287 * 10f86be3e564f2e463e45420eb5f9fbdb14f7427eac665cd9cc7901efbc4cc59 * 1c218d15b35b79d762b966db8bc2ca90fc62a95903bd78ac85648de1d828dbce * 34170bda5eb84d737577096438a776a968cb36eff88817f12317edcb9d144b35 * 4343fa4e313a61f10de08fa5b1b8acb98589faf5739ab5b606f540983b630f79 * 486a9a79bbb81abee2e81679ace6267c3f3e37d9b8c8074f9ec7aebc9be75cdd * 589e22005aa166b207a7aa7384dd3c7f90b71775688e587108801c3894a43358 * 5e820d8b2bd139b3018574c349cd48ce77e7b31cf85e9462712167fcab99b30a * 6e065f1e4d1d8232da5de830d270a13fff8284a91e81c060377ebe66aa75d81d * 8563eecbc85a0c43b689b9d9f31fe5977e630c276dee0d7dbfe1a47ab1ab4550 * 8de446957ce96826628c88da9fd4e7ff9d6327d8004afc4e9e86d59e7d6948dc * 9ece783ac52c9ec2f6bdfa669763a7ed1bbb24af1e04e029a0a91954582690cf * a69e89a62203b8f2f89ec12a13e46c71b6b4d505deb19527ff73fd002df9bc6b * ad8a819d7b68905fa6a8425295755c329504dd0bb48b2fba8dd17e54562b0c6f * b9be6b0ac414ac2a033c17c3ac649417e97e5d0580db796a8ff55169299de50e * cde5afd20b7bb5c9457b68e02c13094125025fb974df425020361303dc6fcdfc * d0a5b9dc988834cc930624661e6e7dd1943d480d75594fff0f4bc39d229c5999 * e0568196f1494137a5bbee897a37bc4fe15f87175b57a30403450a88486190c4 * f08e88c7397443e35697e145887af2683a83d2415ccd0c7536cea09e35da9ef7 Back to top ### Tags * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [BeaverTail](https://unit42.paloaltonetworks.com/tag/beavertail/ "BeaverTail") * [CL-STA-240](https://unit42.paloaltonetworks.com/tag/cl-sta-240/ "CL-STA-240") * [Contagious Interview](https://unit42.paloaltonetworks.com/tag/contagious-interview/ "Contagious Interview") * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/ "DPRK") * [InvisibleFerret](https://unit42.paloaltonetworks.com/tag/invisibleferret/ "InvisibleFerret") * [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/ "North Korea") * [Python](https://unit42.paloaltonetworks.com/tag/python/ "Python") * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/ "social engineering") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection](https://unit42.paloaltonetworks.com/detecting-dns-tunneling-campaigns/ "No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection") ### Table of Contents * ### Related Articles * [Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "article - table of contents") * [The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "article - table of contents") * [Inside the Modern SOC: The Identity Front Door](https://unit42.paloaltonetworks.com/soc-identity-front-door/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") ![Pictorial representation of malware bypassing DNS and communicating directly to IP addresses. Futuristic digital cityscape with glowing blue and orange geometric structures, resembling skyscrapers.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_DNS_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 4, 2026 [#### Almost Half of Malware Samples Communicate Direct to IP](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/) * [Command and Control](https://unit42.paloaltonetworks.com/tag/command-and-control/ "Command and Control") * [D2IP](https://unit42.paloaltonetworks.com/tag/d2ip/ "D2IP") * [Exfiltration](https://unit42.paloaltonetworks.com/tag/exfiltration/ "exfiltration") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/ "Almost Half of Malware Samples Communicate Direct to IP") ![Pictorial representation of passwordless authentication. East Asian woman examining data on multiple screens in a high-tech environment, surrounded by digital graphics and code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/07_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 3, 2026 [#### Pass the Passkey: A Novel Attack Surface in Passwordless Authentication](https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/) * [Google authenticator](https://unit42.paloaltonetworks.com/tag/google-authenticator/ "google authenticator") * [Google Chrome](https://unit42.paloaltonetworks.com/tag/google-chrome/ "Google Chrome") * [Google Cloud](https://unit42.paloaltonetworks.com/tag/google-cloud/ "Google Cloud") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/ "Pass the Passkey: A Novel Attack Surface in Passwordless Authentication") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)