Palo Alto Networks Unit 42

ID: c8d50a5a-c805-599d-99ad-5b5f5e92b089

STIX ID: identity--c8d50a5a-c805-599d-99ad-5b5f5e92b089

Feed Type: rss

Earliest post: 2024-03-15

Latest post: 2026-10-07

Deep-dive threat research, malware analysis, and intelligence from Palo Alto Networks’ elite Unit 42 team.

Exclude posts that do not describe a security incident

Classification

Min Pub Date

01/01/2020

Max Pub Date

10/14/2026

Title	Date Published ↓	Threat Score	Author	Visible
Evolution of Web3 in Cloud Supply Chain Attacks	2026-10-07	90	Eyal Rafian	True
Blinder Tunnel Campaign Targets Iraqi Infrastructure	2026-10-06	90	Unit 42	True
OperTraitors: How Kubernetes Operators Betray Your Security Posture	2026-09-29	70	Lior Yakim	True
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild	2026-09-28	90	Unit 42	True
From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies	2026-09-21	50	Margaret Kelley	True
A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity	2026-09-18	70	Niv Rabin	True
Atomic macOS (AMOS) Stealer Activity	2026-09-16	75	Bradley Duncan	True
The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE	2026-09-10	60	Eviatar Garzi	True
Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure	2026-09-09	75	Rem Dudas	True
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America	2026-09-03	75	Reese Lewis and Sara McBroom	True
An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation	2026-09-02	80	Renzon Cruz, Nicolas Bareil, Eric Semaan and Omar Jbari	True
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams	2026-08-31	78	Noam Sala	True
The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution	2026-08-25	55	Sara McBroom	True
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain	2026-08-21	88	Yaron Avital	True
Identity Abuse Through Trusted Communication Channels	2026-08-20	75	Bill Batchelor	True
Kimwolf v7: An Evolution of the Kimwolf Botnet	2026-08-11	75	Asher Davila, Chris Navarrete and Doel Santos	True
The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications	2026-08-10	78	Chris Navarrete, Sai Sathvik Ruppa and Haozhe Zhang	True
Inside the Modern SOC: The Identity Front Door	2026-08-07	70	Sharon Maydar	True
ChainDrop: Inside a Self-Propagating npm Worm	2026-08-06	88	Unit 42	True
Token Jacking: Cybercriminals Could Be Stealing Your AI Resources	2026-08-06	75	Unit 42	True
The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software	2026-08-04	75	Xu Zou	True
Almost Half of Malware Samples Communicate Direct to IP	2026-08-04	75	Shu Wang, Zhanhao Chen and Daiping Liu	True
Pass the Passkey: A Novel Attack Surface in Passwordless Authentication	2026-08-03	78	Arie Olshtein	True
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version	2026-07-31	88	Adva Gabay and Noa Dekel	True
Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks	2026-07-30	78	Andy Piazza	True
Russian Global Webmail Espionage	2026-07-23	88	Unit 42	True
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy	2026-07-17	85	Emmanuel Zhou, Adam Robbie, Rick Wyble and Miguel Pereira	True
AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report	2026-07-16	50	Ria Bhatia	True
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development	2026-07-15	78	Chris Navarrete, Asher Davila and Doel Santos	True
No Manners Here: The Ruthless Rise of The Gentlemen Ransomware	2026-07-10	85	Matt Brady	True
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation	2026-07-07	70	Bharath Nannaka and Pranay Kumar Chhaparwal	True
Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector	2026-07-01	80	Keerthiraj Nagaraj, Diva-Oriane Marty, Beliz Kaleli and Oleksii Starov	True
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure	2026-06-25	90	Unit 42	True
OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat	2026-06-23	75	Shresta Bellary Seetharam, Nabeel Mohamed, Billy Melicher and Oleksii Starov	True
The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration	2026-06-22	70	Yahav Festinger	True
Threat Brief: Mitigating Large-Scale Credential Attacks	2026-06-20	72	Andy Piazza	True
Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE	2026-06-16	75	Ori Hadad	True
Inside the Modern SOC: The 72-Minute Race	2026-06-15	70	Sharon Maydar	True
Trust No Skill: Integrity Verification for AI Agent Supply Chains	2026-06-11	72	Yuhao Wu, Tony Li and Hongliang Liu	True
Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility	2026-06-09	70	Yahav Festinger	True
When “Hi, This Is IT” Comes Through Microsoft Teams	2026-06-08	70	Bill Batchelor	True
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257	2026-06-05	70	Andy Piazza and Unit 42	True
Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor	2026-06-02	78	Ido Asher, Noa Dekel and Tom Fakterman	True
2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface	2026-05-28	90	Justin Moore	True
Out of the Crypt: The Evolving Cyber Extortion Economy	2026-05-27	85	Matt Brady and Justin Moore	True
Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns	2026-05-22	90	Unit 42	True
Paved With Intent: ROADtools and Nation-State Tactics in the Cloud	2026-05-22	85	Bill Batchelor and Eyal Rafian	True
Tracking TamperedChef Clusters via Certificate and Code Reuse	2026-05-20	75	Joseph Ganter	True
Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files	2026-05-15	70	Pranay Kumar Chhaparwal and Mark Lim	True
Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools	2026-05-11	80	Stav Setty, Tom Fakterman and Shachar Roitman	True