Nation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack

A suspected nation‑state threat actor has been linked to a new malware called Airstalk, described by Palo Alto Networks Unit 42 as part of a likely supply chain attack and tracked under the moniker CL-STA-1009. According to Palo Alto Networks Unit 42, the malware, which comes in PowerShell and .NET variants, uses the AirWatch API for mobile device management (MDM)—now Workspace ONE Unified Endpoint Management—to establish a covert command-and-control channel and manage custom device attributes and file uploads.

The backdoor is capable of taking screenshots and harvesting cookies, browser history, and bookmarks from web browsers, with the .NET variant reportedly broader in scope and more capable, including targeting Edge and Island browsers and mimicking an AirWatch Helper utility. It communicates via the PowerShell variant’s /api/mdm/devices/ endpoint to fetch device details and use the API’s custom attributes as a dead drop resolver for attacker communication.

Early samples are signed with a likely stolen certificate, and some have a June 28, 2024 compilation timestamp, suggesting development over the past year. The researchers note that the attack surface appears to involve enterprise environments and BPO sectors, leveraging third‑party environments to maintain access.