Nation-State Espionage: Airstalk Malware Hijacks VMware AirWatch (MDM) API for Covert C2 Channel

Palo Alto Networks’ Unit 42 Threat Intelligence team has uncovered Airstalk, a Windows-based malware family that hijacks VMware AirWatch (Workspace ONE) MDM APIs to create a covert C2 channel. According to Unit 42, the Airstalk toolkit is available in PowerShell and .NET variants, with the latter adding multi-threaded communication, versioning, and enhanced persistence.

The campaign, tracked as activity cluster CL-STA-1009, is believed to have originated from a supply chain compromise, targeting organisations through trusted third-party vendors and BPO entities. Airstalk abuses the AirWatch API to disguise traffic as legitimate MDM activity, using the /api/mdm/devices/ endpoint and embedding commands within custom device attributes to form a dead-drop style exchange for tasks such as taking screenshots and exfiltrating data.

The .NET variant is more advanced, supports regular beaconing every 10 minutes, and can exfiltrate cookies, bookmarks, browsing history and screenshots from Chrome, Edge and Island Browser, with some samples signed using a stolen certificate later revoked.