Palo Alto Networks Unit 42

ID: c8d50a5a-c805-599d-99ad-5b5f5e92b089

STIX ID: identity--c8d50a5a-c805-599d-99ad-5b5f5e92b089

Feed Type: rss

Earliest post: 2024-03-15

Latest post: 2026-08-25

Deep-dive threat research, malware analysis, and intelligence from Palo Alto Networks’ elite Unit 42 team.

Exclude posts that do not describe a security incident

Classification

Min Pub Date

01/01/2020

Max Pub Date

08/28/2026

Title	Date Published ↓	Describes Incident	Author	Visible
The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution	2026-08-25	True	Sara McBroom	True
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain	2026-08-21	True	Yaron Avital	True
Identity Abuse Through Trusted Communication Channels	2026-08-20	True	Bill Batchelor	True
Kimwolf v7: An Evolution of the Kimwolf Botnet	2026-08-11	True	Asher Davila, Chris Navarrete and Doel Santos	True
The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications	2026-08-10	True	Chris Navarrete, Sai Sathvik Ruppa and Haozhe Zhang	True
Inside the Modern SOC: The Identity Front Door	2026-08-07	True	Sharon Maydar	True
ChainDrop: Inside a Self-Propagating npm Worm	2026-08-06	True	Unit 42	True
Token Jacking: Cybercriminals Could Be Stealing Your AI Resources	2026-08-06	True	Unit 42	True
The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software	2026-08-04	True	Xu Zou	True
Almost Half of Malware Samples Communicate Direct to IP	2026-08-04	True	Shu Wang, Zhanhao Chen and Daiping Liu	True
Pass the Passkey: A Novel Attack Surface in Passwordless Authentication	2026-08-03	True	Arie Olshtein	True
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version	2026-07-31	True	Adva Gabay and Noa Dekel	True
Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks	2026-07-30	True	Andy Piazza	True
Russian Global Webmail Espionage	2026-07-23	True	Unit 42	True
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy	2026-07-17	True	Emmanuel Zhou, Adam Robbie, Rick Wyble and Miguel Pereira	True
AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report	2026-07-16	True	Ria Bhatia	True
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development	2026-07-15	True	Chris Navarrete, Asher Davila and Doel Santos	True
No Manners Here: The Ruthless Rise of The Gentlemen Ransomware	2026-07-10	True	Matt Brady	True
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation	2026-07-07	True	Bharath Nannaka and Pranay Kumar Chhaparwal	True
Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector	2026-07-01	True	Keerthiraj Nagaraj, Diva-Oriane Marty, Beliz Kaleli and Oleksii Starov	True
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure	2026-06-25	True	Unit 42	True
OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat	2026-06-23	True	Shresta Bellary Seetharam, Nabeel Mohamed, Billy Melicher and Oleksii Starov	True
The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration	2026-06-22	True	Yahav Festinger	True
Threat Brief: Mitigating Large-Scale Credential Attacks	2026-06-20	True	Andy Piazza	True
Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE	2026-06-16	True	Ori Hadad	True
Inside the Modern SOC: The 72-Minute Race	2026-06-15	True	Sharon Maydar	True
Trust No Skill: Integrity Verification for AI Agent Supply Chains	2026-06-11	True	Yuhao Wu, Tony Li and Hongliang Liu	True
Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility	2026-06-09	True	Yahav Festinger	True
When “Hi, This Is IT” Comes Through Microsoft Teams	2026-06-08	True	Bill Batchelor	True
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257	2026-06-05	True	Andy Piazza and Unit 42	True
Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor	2026-06-02	True	Ido Asher, Noa Dekel and Tom Fakterman	True
2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface	2026-05-28	True	Justin Moore	True
Out of the Crypt: The Evolving Cyber Extortion Economy	2026-05-27	True	Matt Brady and Justin Moore	True
Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns	2026-05-22	True	Unit 42	True
Paved With Intent: ROADtools and Nation-State Tactics in the Cloud	2026-05-22	True	Bill Batchelor and Eyal Rafian	True
Tracking TamperedChef Clusters via Certificate and Code Reuse	2026-05-20	True	Joseph Ganter	True
Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files	2026-05-15	True	Pranay Kumar Chhaparwal and Mark Lim	True
Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools	2026-05-11	True	Stav Setty, Tom Fakterman and Shachar Roitman	True
Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution	2026-05-07	True	Justin Moore and Unit 42	True
Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years	2026-05-05	True	Justin Moore	True
Essential Data Sources for Detection Beyond the Endpoint	2026-05-01	True	Corey Berman and Matt Gayford	True
That AI Extension Helping You Write Emails? It’s Reading Them First	2026-04-30	True	Shresta Bellary Seetharam, Nabeel Mohamed, Billy Melicher, Oleksii Starov, Qinge Xie and Fang Liu	True
The npm Threat Landscape: Attack Surface and Mitigations	2026-04-24	True	Unit 42	True
TGR-STA-1030: New Activity in Central and South America	2026-04-24	True	Unit 42	True
Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System	2026-04-23	True	Yahav Festinger and Chen Doytshman	True
When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks	2026-04-22	True	Emmanuel Zhou, Adam Robbie, Rick Wyble, Zhutian Liu, Zhiyun Qian, Zhaowei Tan, Srikanth V. Krishnamurthy and Mathy Vanhoef	True
Fracturing Software Security With Frontier AI Models	2026-04-20	True	Andy Piazza	True
A Deep Dive Into Attempted Exploitation of CVE-2023-33538	2026-04-16	True	Asher Davila, Malav Vyas and Chris Navarrete	True
Cracks in the Bedrock: Agent God Mode	2026-04-08	True	Ori Hadad	True
Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox	2026-04-07	True	Ori Hadad	True