Fake Palo Alto GlobalProtect used as lure to backdoor enterprises

**Targeted Fake GlobalProtect Malware Campaign:** Researchers at Trend Micro uncovered a targeted campaign against Middle Eastern organizations where attackers distribute a fake Palo Alto GlobalProtect installer that runs stealthily, checks for sandboxes, profiles victims, and communicates with freshly registered C2 domains (e.g., containing "sharjahconnect") using AES-encrypted traffic and Interactsh beacons; it supports remote PowerShell execution and file upload/download, enabling further lateral movement and data exfiltration.