GlobalProtect VPN portals probed with 2.3 million scan sessions

GreyNoise reported a significant escalation in malicious scanning of Palo Alto Networks GlobalProtect VPN login portals beginning 14 November 2025, with a 40x 24-hour surge and ~2.3 million sessions to the /global-protect/login.esp endpoint observed through 19 November. The activity is linked to prior campaigns by recurring fingerprints and ASN reuse (notably AS200373 and AS208885), targets regions including the US, Mexico and Pakistan, and—while historically such spikes often precede vulnerability disclosures—Palo Alto Networks reported no evidence of compromise after investigation.