Publisher
Stories with reporting from Palo Alto Unit 42, ranked by what is gaining ground now. Each story links to the original articles.
Unit 42 reports on threat actors using Web3 infrastructure and open-source supply-chain attacks to breach enterprise cloud environments. The analysis focuses on how these techniques are being used together in attacks.
Citrix reports that CVE-2026-88771 and CVE-2026-88772 affecting NetScaler devices are being exploited in the wild. Unit 42 flags possible zero-day activity, making the vulnerabilities an active concern for NetScaler operators.
A campaign called Blinder Tunnel targets Iraqi critical infrastructure using fake Dubai Airports recruitment lures and malware that uses GitHub for command and control. The activity is attributed to an Iran-nexus campaign.
An analysis describes how default settings in AWS AgentCore Harness can allow prompt injection to expose credentials. It outlines steps for securing agents built with the harness.
Unit 42 describes an investigation into an attacker using autonomous AI agents to breach an enterprise network within hours. The account concerns agentic attacks and defensive measures for organizations facing them.
Unit 42 presents perturbation probing as a diagnostic for weaknesses in large language model safety refusals. Its research argues that refusal behavior relies on a thin neural layer, underscoring the need for security beyond the model itself.
A Unit 42 analysis describes how attackers with root access on a compromised Kubernetes node can use SPIFFE/SPIRE metadata to spoof and harvest identities belonging to workloads on the same node. The technique targets workload identity in environments using SPIFFE/SPIRE.
Attackers targeting organizations in Latin America use AI in operations that include data exfiltration. The account says basic operational-security mistakes give defenders opportunities to disrupt them.
Unit 42 introduces OperTraitor, a tool for auditing Kubernetes operator privileges and identifying excessive RBAC risks. The tool focuses on securing non-human identities.
Unit 42 reports activity involving Atomic macOS (AMOS) Stealer, malware that uses deceptive setup guides to steal credentials and sensitive user data. The report focuses on identifying and blocking these threats.
A Unit 42 investigation describes cybercriminals using YouTube gaming lures and SEO poisoning to deliver multiple malware payloads to enterprise networks. The campaign exploits commodity infrastructure to reach organizational systems.
Unit 42 examines the Spring Ring campaign, which abuses Microsoft Teams voice phishing to deploy malware and target enterprise domain controllers.
Unit 42 describes a behavioral clustering model that uses cloud audit logs to infer identity roles and support continuous threat detection through standard SQL queries.
Unit 42 describes using AWS managed policies to neutralize exposed IAM credentials. Its approach includes GitHub secret scanning and CloudTrail monitoring.
Unit 42 discusses how security operations teams can investigate attacks that pivot across environments. It presents Managed XSIAM as a way to help teams trace complete attack paths.
Unit 42 experts address three cybersecurity misconceptions and offer practical advice for strengthening enterprise defenses.
