Insights, news, education and announcements from PolySwarm | PowerShell malware

Airstalk Used in Supply Chain Attacks

Nov 7, 2025 12:58:20 PM / by The Hivemind posted in Threat Bulletin, Supply Chain Attack, PowerShell malware, Airstalk Malware, Browser Exfiltration, AirWatch API, MDM Abuse, Nation-State Actor, .NET Malware, CL-STA-1009

Verticals Targeted: Business Process Outsourcing (BPO)
Regions Targeted: Not Specified
Related Families: None

Executive Summary

Airstalk is a new Windows malware family deployed by a suspected nation-state actor in supply chain attacks, leveraging AirWatch API for covert C2 to exfiltrate browser data. Available in PowerShell and .NET variants, the malware highlights evolving threats to third-party vendors.

Read More

AdaptixC2

Oct 20, 2025 4:00:36 PM / by The Hivemind posted in Threat Bulletin, Emerging Threat, PowerShell malware, AdaptixC2, post-exploitation framework, C2 framework, AI-generated malware

Verticals Targeted: Financial
Regions Targeted: Asia
Related Families: Fog Ransomware

Executive Summary

AdaptixC2, an open-source command-and-control framework, has emerged as a potent tool for threat actors, enabling file manipulation, data exfiltration, and covert network communication in attacks. Its modular design and AI-assisted deployment methods underscore the need for robust defenses to counter its evolving tactics.

Read More