Palo Alto Networks Unit 42

ID: c8d50a5a-c805-599d-99ad-5b5f5e92b089

STIX ID: identity--c8d50a5a-c805-599d-99ad-5b5f5e92b089

Feed Type: rss

Earliest post: 2024-03-15

Latest post: 2026-07-10

Deep-dive threat research, malware analysis, and intelligence from Palo Alto Networks’ elite Unit 42 team.

Exclude posts that do not describe a security incident

Classification

Min Pub Date

01/01/2020

Max Pub Date

07/14/2026

Title	Date Published ↓	Describes Incident	Author	Visible
Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector	2026-07-01	True	Keerthiraj Nagaraj, Diva-Oriane Marty, Beliz Kaleli and Oleksii Starov	True
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure	2026-06-25	True	Unit 42	True
OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat	2026-06-23	True	Shresta Bellary Seetharam, Nabeel Mohamed, Billy Melicher and Oleksii Starov	True
The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration	2026-06-22	True	Yahav Festinger	True
Threat Brief: Mitigating Large-Scale Credential Attacks	2026-06-20	True	Andy Piazza	True
Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE	2026-06-16	True	Ori Hadad	True
Inside the Modern SOC: The 72-Minute Race	2026-06-15	True	Sharon Maydar	True
Trust No Skill: Integrity Verification for AI Agent Supply Chains	2026-06-11	True	Yuhao Wu, Tony Li and Hongliang Liu	True
Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility	2026-06-09	True	Yahav Festinger	True
When “Hi, This Is IT” Comes Through Microsoft Teams	2026-06-08	True	Bill Batchelor	True
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257	2026-06-05	True	Andy Piazza and Unit 42	True
Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor	2026-06-02	True	Ido Asher, Noa Dekel and Tom Fakterman	True
2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface	2026-05-28	True	Justin Moore	True
Out of the Crypt: The Evolving Cyber Extortion Economy	2026-05-27	True	Matt Brady and Justin Moore	True
Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns	2026-05-22	True	Unit 42	True
Paved With Intent: ROADtools and Nation-State Tactics in the Cloud	2026-05-22	True	Bill Batchelor and Eyal Rafian	True
Tracking TamperedChef Clusters via Certificate and Code Reuse	2026-05-20	True	Joseph Ganter	True
Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files	2026-05-15	True	Pranay Kumar Chhaparwal and Mark Lim	True
Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools	2026-05-11	True	Stav Setty, Tom Fakterman and Shachar Roitman	True
Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution	2026-05-07	True	Justin Moore and Unit 42	True
Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years	2026-05-05	True	Justin Moore	True
Essential Data Sources for Detection Beyond the Endpoint	2026-05-01	True	Corey Berman and Matt Gayford	True
That AI Extension Helping You Write Emails? It’s Reading Them First	2026-04-30	True	Shresta Bellary Seetharam, Nabeel Mohamed, Billy Melicher, Oleksii Starov, Qinge Xie and Fang Liu	True
The npm Threat Landscape: Attack Surface and Mitigations	2026-04-24	True	Unit 42	True
TGR-STA-1030: New Activity in Central and South America	2026-04-24	True	Unit 42	True
Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System	2026-04-23	True	Yahav Festinger and Chen Doytshman	True
When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks	2026-04-22	True	Emmanuel Zhou, Adam Robbie, Rick Wyble, Zhutian Liu, Zhiyun Qian, Zhaowei Tan, Srikanth V. Krishnamurthy and Mathy Vanhoef	True
Fracturing Software Security With Frontier AI Models	2026-04-20	True	Andy Piazza	True
A Deep Dive Into Attempted Exploitation of CVE-2023-33538	2026-04-16	True	Asher Davila, Malav Vyas and Chris Navarrete	True
Cracks in the Bedrock: Agent God Mode	2026-04-08	True	Ori Hadad	True
Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox	2026-04-07	True	Ori Hadad	True
Understanding Current Threats to Kubernetes Environments	2026-04-06	True	Eyal Rafian and Bill Batchelor	True
When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications	2026-04-03	True	Jay Chen and Royce Lu	True
Threat Brief: Widespread Impact of the Axios Supply Chain Attack	2026-04-01	True	Unit 42	True
Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure	2026-03-31	True	Unit 42	True
Double Agents: Exposing Security Blind Spots in GCP Vertex AI	2026-03-31	True	Ofir Shaty	True
Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government	2026-03-26	True	Doel Santos and Hiroaki Hara	True
Threat Brief: Recruiting Scheme Impersonating Palo Alto Networks Talent Acquisition Team	2026-03-24	True	Justin Moore	True
Google Authenticator: The Hidden Mechanisms of Passwordless Authentication	2026-03-23	True	Arie Olshtein	True
Who’s Really Shopping? Retail Fraud in the Age of Agentic AI	2026-03-20	True	Matt Brady and Christa McHugh	True
Analyzing the Current State of AI Use in Malware	2026-03-19	True	Unit 42	True
Open, Closed and Broken: Prompt Fuzzing Finds LLMs Still Fragile Across Open and Closed Models	2026-03-17	True	Yu Fu, May Wang, Royce Lu and Shengming Xu	True
Boggy Serpens Threat Assessment	2026-03-16	True	Unit 42	True
Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization	2026-03-16	True	Justin Moore	True
Insights: Increased Risk of Wiper Attacks	2026-03-12	True	Andy Piazza, Eric Goldstrom and Steve Elovitz	True
Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia	2026-03-12	True	Lior Rochberger and Yoav Zemah	True
Auditing the Gatekeepers: Fuzzing "AI Judges" to Bypass Security Controls	2026-03-10	True	Tony Li, Hongliang Liu and Yuhao Wu	True
An Investigation Into Years of Undetected Operations Targeting High-Value Sectors	2026-03-06	True	Tom Fakterman	True
Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild	2026-03-03	True	Beliz Kaleli, Shehroze Farooqi, Oleksii Starov and Nabeel Mohamed	True
Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran	2026-03-03	True	Unit 42	True