PatheticSlug is a name Cloudflare's Cloudforce One threat intelligence team uses for a North Korea-linked threat actor referenced in Cloudflare's 2026 threat report as an example of a broader industry shift toward abusing trusted cloud platforms to mask malicious activity. Cloudflare describes the group as exploiting the reputation shield of legitimate cloud ecosystems to disguise payload delivery, specifically using Google Drive and Dropbox to host XenoRAT payloads while leveraging GitHub for covert command-and-control communications, blending its traffic into legitimate enterprise activity rather than relying only on conspicuous attacker-owned infrastructure and communications.