Unit 42 https://unit42.paloaltonetworks.com/ Palo Alto Networks Wed, 08 Jul 2026 18:40:42 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.4 https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-Unit42-180x180-1.png Unit 42 https://unit42.paloaltonetworks.com/ 32 32 noPalo Alto Networks Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ Tue, 07 Jul 2026 22:00:21 +0000 https://unit42.paloaltonetworks.com/?p=183287 A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination.

The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation appeared first on Unit 42.

]]> 10 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/01_Malware_Category_1920x900-2-300x300.jpg 10 A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination. The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation appeared first on Unit 42.A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination. The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation appeared first on Unit 42.Malware, Threat Research, AMSI, Cryptocurrency, DLL Sideloading, Factory-v3, malvertising, X3D MINER How We Added WebAuthn to a Browser-Based RDP Client https://unit42.paloaltonetworks.com/webauthn-added-to-browser-based-rdp/ Thu, 02 Jul 2026 22:00:39 +0000 https://unit42.paloaltonetworks.com/?p=183236 A look inside the reverse-engineering journey of building the first RDP client outside of Windows to support WebAuthn redirection.

The post How We Added WebAuthn to a Browser-Based RDP Client appeared first on Unit 42.

]]> 8 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Myth-Busting_Overview_1920x900-300x300.jpg 8 A look inside the reverse-engineering journey of building the first RDP client outside of Windows to support WebAuthn redirection. The post How We Added WebAuthn to a Browser-Based RDP Client appeared first on Unit 42.A look inside the reverse-engineering journey of building the first RDP client outside of Windows to support WebAuthn redirection. The post How We Added WebAuthn to a Browser-Based RDP Client appeared first on Unit 42.General, Insights, Threat Research, IDA Pro, Microsoft, RDP Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/ Wed, 01 Jul 2026 01:00:11 +0000 https://unit42.paloaltonetworks.com/?p=183096 Attackers can exploit LLM domain hallucinations through phantom squatting to target supply chains. Read the analysis to learn more.

The post Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector appeared first on Unit 42.

]]> 19 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_799983387-1-1-300x300.jpg 19 Attackers can exploit LLM domain hallucinations through phantom squatting to target supply chains. Read the analysis to learn more. The post Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector appeared first on Unit 42.Attackers can exploit LLM domain hallucinations through phantom squatting to target supply chains. Read the analysis to learn more. The post Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector appeared first on Unit 42.Malware, Threat Research, Agentic AI, LLMs, Malicious Domains, malvertising, Phantom Squatting, phishing, slopsquatting, supply chain, URL hallucination Threat Brief: Mitigating Large-Scale Credential Attacks https://unit42.paloaltonetworks.com/large-scale-credential-attacks/ Fri, 26 Jun 2026 19:05:33 +0000 https://unit42.paloaltonetworks.com/?p=182713 We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices.

The post Threat Brief: Mitigating Large-Scale Credential Attacks appeared first on Unit 42.

]]> 5 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-1-300x300.jpg 5 We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices. The post Threat Brief: Mitigating Large-Scale Credential Attacks appeared first on Unit 42.We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices. The post Threat Brief: Mitigating Large-Scale Credential Attacks appeared first on Unit 42.General, High Profile Threats, credential theft, fortibleed, password spraying CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/ Thu, 25 Jun 2026 22:00:52 +0000 https://unit42.paloaltonetworks.com/?p=182868 Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor.

The post CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure appeared first on Unit 42.

]]> 10 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/03_Malware_Category_1920x900-5-300x300.jpg 10 Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor. The post CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure appeared first on Unit 42.Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor. The post CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure appeared first on Unit 42.Malware, Threat Research, backdoor, CL-STA-1062, malware, Mimikatz, southeast asia, TinyRCT, VPN, web shells OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/ Tue, 23 Jun 2026 22:00:51 +0000 https://unit42.paloaltonetworks.com/?p=182742 Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute agentic financial fraud.

The post OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat appeared first on Unit 42.

]]> 9 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_768915868-1-300x300.jpg 9 Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute agentic financial fraud. The post OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat appeared first on Unit 42.Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute agentic financial fraud. The post OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat appeared first on Unit 42.Malware, Threat Research, Agentic AI, ClawHavoc, ClawHub, defense evasion, Infostealer, OpenClaw, payload, VirusTotal The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ Mon, 22 Jun 2026 22:00:04 +0000 https://unit42.paloaltonetworks.com/?p=182610 Unit 42 research details how attackers could exploit global name uniqueness in bucket hijacking to redirect cloud data streams across major CSPs.

The post The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration appeared first on Unit 42.

]]> 13 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/09_Cloud_cybersecurity_research_Overview_1920x900-300x300.jpg 13 Unit 42 research details how attackers could exploit global name uniqueness in bucket hijacking to redirect cloud data streams across major CSPs. The post The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration appeared first on Unit 42.Unit 42 research details how attackers could exploit global name uniqueness in bucket hijacking to redirect cloud data streams across major CSPs. The post The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration appeared first on Unit 42.Cloud Cybersecurity Research, Threat Research, AWS, bucket hijacking, cloud data exfiltration, cloud logging, CSPs, Google Cloud, IAM, Microsoft Azure, privilege escalation Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/ Tue, 16 Jun 2026 10:00:29 +0000 https://unit42.paloaltonetworks.com/?p=182510 Unit 42 discovered a Vertex AI Python SDK vulnerability that allows remote code execution via bucket squatting. Read the article for more.

The post Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE appeared first on Unit 42.

]]> 12 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_1270203474-1-300x300.png 12 Unit 42 discovered a Vertex AI Python SDK vulnerability that allows remote code execution via bucket squatting. Read the article for more. The post Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE appeared first on Unit 42.Unit 42 discovered a Vertex AI Python SDK vulnerability that allows remote code execution via bucket squatting. Read the article for more. The post Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE appeared first on Unit 42.Cloud Cybersecurity Research, Threat Research, bucket squatting, Google Cloud, joblib, Python, RCE, SDKs, Vertex AI, vulnerability Inside the Modern SOC: The 72-Minute Race https://unit42.paloaltonetworks.com/soc-72-minute-race/ Mon, 15 Jun 2026 23:00:19 +0000 https://unit42.paloaltonetworks.com/?p=182568 Attackers can move from access to exfiltration in 72 minutes. Learn how modern SOC teams close the speed gap with Unit 42's AI-driven automation, threat hunting, MDR and Managed XSIAM.

The post Inside the Modern SOC: The 72-Minute Race appeared first on Unit 42.

]]> 4 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/02_Interview_Overview_1920x900-300x300.jpg 4 Attackers can move from access to exfiltration in 72 minutes. Learn how modern SOC teams close the speed gap with Unit 42's AI-driven automation, threat hunting, MDR and Managed XSIAM. The post Inside the Modern SOC: The 72-Minute Race appeared first on Unit 42.Attackers can move from access to exfiltration in 72 minutes. Learn how modern SOC teams close the speed gap with Unit 42's AI-driven automation, threat hunting, MDR and Managed XSIAM. The post Inside the Modern SOC: The 72-Minute Race appeared first on Unit 42.Inside the Modern SOC, Insights, identity, operation security, Unit 42 Incident Response Report Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/ Fri, 12 Jun 2026 22:00:14 +0000 https://unit42.paloaltonetworks.com/?p=182477 Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn more here.

The post Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered appeared first on Unit 42.

]]> 3 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/11_Listicle_Category_1505x922-300x300.jpg 3 Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn more here. The post Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered appeared first on Unit 42.Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn more here. The post Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered appeared first on Unit 42.General, Insights, digital forensics, macOS Trust No Skill: Integrity Verification for AI Agent Supply Chains https://unit42.paloaltonetworks.com/ai-agent-supply-chain-risks/ Thu, 11 Jun 2026 10:00:24 +0000 https://unit42.paloaltonetworks.com/?p=182196 Protect enterprise AI agents from supply chain risks by auditing third-party skills for hidden vulnerabilities and multi-stage attack chains.

The post Trust No Skill: Integrity Verification for AI Agent Supply Chains appeared first on Unit 42.

]]> 7 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_429594706-300x300.jpg 7 Protect enterprise AI agents from supply chain risks by auditing third-party skills for hidden vulnerabilities and multi-stage attack chains. The post Trust No Skill: Integrity Verification for AI Agent Supply Chains appeared first on Unit 42.Protect enterprise AI agents from supply chain risks by auditing third-party skills for hidden vulnerabilities and multi-stage attack chains. The post Trust No Skill: Integrity Verification for AI Agent Supply Chains appeared first on Unit 42.Malware, Threat Research, AI agents, credential exfiltration, LLMs, OpenClaw, supply chain Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility https://unit42.paloaltonetworks.com/cloud-logging-defense-evasion/ Tue, 09 Jun 2026 22:00:21 +0000 https://unit42.paloaltonetworks.com/?p=182090 Unit 42 research examines attack scenarios targeting cloud logging services. Learn how to defend against log manipulation and defense evasion.

The post Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility appeared first on Unit 42.

]]> 12 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/11_Cloud_cybersecurity_research_Overview_1920x900-300x300.jpg 12 Unit 42 research examines attack scenarios targeting cloud logging services. Learn how to defend against log manipulation and defense evasion. The post Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility appeared first on Unit 42.Unit 42 research examines attack scenarios targeting cloud logging services. Learn how to defend against log manipulation and defense evasion. The post Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility appeared first on Unit 42.Cloud Cybersecurity Research, Threat Research, AWS CloudTrail, cloud logging, defense evasion, Google Cloud, log poisoning, log router, log storage, S3 Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ Tue, 09 Jun 2026 14:05:42 +0000 https://unit42.paloaltonetworks.com/?p=182026 We include indicators of activity and mitigations for PAN-OS vulnerability CVE-2026-0257.

The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 appeared first on Unit 42.

]]> 3 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-300x300.jpg 3 We include indicators of activity and mitigations for PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 appeared first on Unit 42.We include indicators of activity and mitigations for PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 appeared first on Unit 42.High Profile Threats, Vulnerabilities, CVE-2026-0257, vulnerability When “Hi, This Is IT” Comes Through Microsoft Teams https://unit42.paloaltonetworks.com/microsoft-teams-phishing/ Mon, 08 Jun 2026 23:00:45 +0000 https://unit42.paloaltonetworks.com/?p=182028 Attackers are increasingly targeting collaboration platforms like Microsoft Teams. Learn the risks and key steps to strengthen your organization's security.

The post When “Hi, This Is IT” Comes Through Microsoft Teams appeared first on Unit 42.

]]> 6 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/02_Opinion_Overview_1920x900-300x300.jpg 6 Attackers are increasingly targeting collaboration platforms like Microsoft Teams. Learn the risks and key steps to strengthen your organization's security. The post When “Hi, This Is IT” Comes Through Microsoft Teams appeared first on Unit 42.Attackers are increasingly targeting collaboration platforms like Microsoft Teams. Learn the risks and key steps to strengthen your organization's security. The post When “Hi, This Is IT” Comes Through Microsoft Teams appeared first on Unit 42.General, Insights, Cloaked Ursa, identity, phishing, social engineering The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2) https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/ Tue, 02 Jun 2026 17:30:33 +0000 https://unit42.paloaltonetworks.com/?p=179395 Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more.

The post The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2) appeared first on Unit 42.

]]> 23 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/05_Malware_Category_1920x900-300x300.jpg 23 Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. The post The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2) appeared first on Unit 42.Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. The post The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2) appeared first on Unit 42.High Profile Threats, Malware, Credential Harvesting, GitHub, npm packages, obfuscation, payload, supply chain, worm propagation