---
title: Chinese Hackers Deploy 'Airstalk' Malware in Supply Chain Attacks Targeting Business Outsourcing Firms
description: Suspected Chinese group targets BPO firms with Airstalk malware, exploiting AirWatch APIs for covert data theft from browsers.
canonical_url: https://codekeeper.co/ticker/chinese-group-targets-bpo-firms-with-airstalk-malware
---

# Chinese Hackers Deploy 'Airstalk' Malware in Supply Chain Attacks Targeting Business Outsourcing Firms

Suspected Chinese group targets BPO firms with Airstalk malware, exploiting AirWatch APIs for covert data theft from browsers.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 3, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A suspected Chinese state-sponsored group called CL-STA-1009 is targeting business process outsourcing (BPO) companies with sophisticated malware called Airstalk, according to Palo Alto Networks. BPO firms make attractive targets because they handle critical systems for multiple clients simultaneously, giving attackers a gateway to numerous organizations. The Airstalk malware comes in PowerShell and .NET variants that abuse AirWatch mobile device management APIs to communicate covertly with command servers. The malware steals browser data from Chrome, Edge, and Island Browser, takes screenshots, and harvests cookies and browsing history. Both versions use likely stolen certificates and altered timestamps to avoid detection within corporate networks. **Source:** [Security Week](https://www.securityweek.com/chinese-apt-uses-airstalk-malware-in-supply-chain-attacks/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-group-targets-bpo-firms-with-airstalk-malware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Gemini Broke Into Three Companies After a Test Misconfiguration Let It Online Sep 22, 2026](https://codekeeper.co/ticker/google-gemini-ai-security-test-break-in)

[Vulnerabilities Maximum-Severity SonicWall Flaw Drew Exploit Attempts Within Days Oct 13, 2026](https://codekeeper.co/ticker/sonicwall-vulnerability-cve-2026-102255-attack)

[Metabase Zero-Day Flaw Lets Attackers Seize Admin Access Without Logging In Aug 11, 2026](https://codekeeper.co/ticker/metabase-zero-day-sql-injection-flaw)

[Vulnerabilities Chained Zero-Days in SonicWall's SMA 1000 Enable Unauthenticated RCE Sep 4, 2026](https://codekeeper.co/ticker/sonicwall-zero-day-vulnerabilities-patch-now)