Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack

According to Unit 42, we have discovered a new Windows-based malware family named Airstalk, available in both PowerShell and .NET variants, and we assess with medium confidence that a possible nation-state threat actor used this malware in a likely supply chain attack, tracked as CL-STA-1009.

The report notes that Airstalk misuses the AirWatch API (now Workspace ONE Unified Endpoint Management) to establish a covert command-and-control channel, primarily via the AirWatch feature to manage browser data and file uploads. The PowerShell variant can exfiltrate cookies, browsing history, bookmarks and take screenshots, while the .NET variant adds further capabilities and targets additional browsers such as Microsoft Edge and Island Browser, with a more complex multi-threaded C2 protocol and versioning.

The analysis also describes signings with a likely stolen certificate and related evasion techniques, including manipulated PE timestamps, and highlights that the activity represents a threat activity cluster named CL-STA-1009. Organizations, especially those working with business process outsourcing and third-party vendors, are advised to monitor for the described C2 patterns and browser data exfiltration behaviours.