Airstalk Malware Exploits AirWatch MDM for Covert C2 Communication

Security researchers have identified Airstalk, a malware family that exploits VMware’s AirWatch API (Workspace ONE Unified Endpoint Management) to establish covert command-and-control channels, rather than relying on traditional network-based C2. The campaign is assessed with medium confidence as a nation-state-sponsored supply chain attack, with two primary variants discovered: PowerShell and a more advanced .NET variant.

Some samples were signed with a likely stolen certificate issued to Aoteng Industrial Automation in China, though the certificate was revoked roughly ten minutes after issuance. The malware uses the AirWatch MDM platform’s legitimate features to hide communications, employing a multi-threaded C2 protocol with versioning and three distinct C2 delivery types in the .NET variant—DEBUG, RESULT and BASE—while also enabling long-term persistence and stealth through trusted management channels.

Both variants target browser data such as cookies, browsing history, bookmarks and screenshots, with the .NET variant extending to Microsoft Edge and Island Browser and signalling evolved exfiltration techniques, including remotely enabling Chrome’s debugging mode to dump cookies. The operation highlights supply chain risks and the potential for attackers to leverage BPO providers as multipliers for access to multiple clients.