"It uses the API to establish a covert command-and-control (C2) channel, primarily through the AirWatch feature ... is capable of capturing screenshots and harvesting cookies, browser history, ...