Airstalk Malware: Multi-Threaded C2 Steals Windows Logins

Cybersecurity researchers have uncovered Airstalk, a Windows malware family available in PowerShell and .NET variants that uses a legitimate mobile device management infrastructure to establish covert command-and-control communications and exfiltrate browser credentials. The .NET variant operates with a multi-threaded architecture, dedicating threads to C2 tasks, exfiltration of debug logs, and beaconing every 10 minutes, while the PowerShell variant relies on the MDM API with JSON messages.

Airstalk leverages the AirWatch API, now Workspace ONE Unified Endpoint Management, exploiting its custom device attributes and file upload features to create a dead-drop communications channel that evades typical security monitoring.

It targets Google Chrome in the PowerShell variant and expands to Microsoft Edge and Island Browser in the .NET version, including a cookie theft capability via Chrome remote debugging, with the latter carrying more sophisticated features such as versioning (versions 13 and 14) and 11 distinct tasks compared with seven in the PowerShell variant.

Researchers note a defence evasion angle, as the .NET binaries are signed with a certificate issued to Aoteng Industrial Automation (Langfang) Co., Ltd., which was revoked about 10 minutes after its issuance on 28 June 2024, and signing timestamps indicate malware activity from July 2024 through January 2025.

The campaign also raises supply chain concerns, as it could enable persistent access through business process outsourcing providers, allowing stolen cookies, screenshots, and credentials to affect multiple victims.