Inside the Modern SOC: The Identity Front Door
The Identity Gap: Why Trust Has Become the New Attack Surface In The 72-Minute Race, we explored how attackers are compressing the time between initial…
Category: Unit42
Token Jacking: Cybercriminals Could Be Stealing Your AI Resources
Executive Summary It’s three a.m., do you know what your AI agent is doing? Unit 42 has responded to a growing number of AI token…
Russian Global Webmail Espionage
Executive Summary Unit 42 has observed a persistent cyberespionage campaign we track as CL-STA-1114. This activity cluster overlaps with activity from a Russian threat actor…
How We Added WebAuthn to a Browser-Based RDP Client
The Pitch TL;DR: We built the first RDP client outside of Windows to support WebAuthn redirection, beating Microsoft’s own macOS, iOS and Linux clients to…
![Unit 42 observed an initial access broker (IAB) on the Russian-language cybercrime forum Exploit[.]in claiming responsibility for this campaign of large-scale credential attacks, referencing a CVE (no further information), and offering the harvested credentials for sale on June 16, 2026. Unit 42 has not validated their claims at this time.](https://image.cybernoz.com/wp-content/uploads/2026/06/Threat-Brief-Mitigating-Large-Scale-Credential-Attacks-600x340.png)
Threat Brief: Mitigating Large-Scale Credential Attacks
Unit 42 is aware of a large-scale password spraying and credential theft campaign (“FortiBleed”) against Fortinet devices. We observed attempts targeting MSSQL devices as well,…
Trust No Skill: Integrity Verification for AI Agent Supply Chains
Executive Summary AI agents now extend their capabilities by installing third-party skills the way smartphones install apps. Anyone can publish a skill to a public…
When “Hi, This Is IT” Comes Through Microsoft Teams
“Hi, IT Department Here!” It’s Friday afternoon. The week has been busy, and everyone is wrapping up before the weekend. One of your workers receives…
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw…
Out of the Crypt: The Evolving Cyber Extortion Economy
Extortion Activity No Longer Requires Encryption for Payment This blog dives into the growing trend of data theft and extortion activities which no longer require…
Gremlin Stealer’s Evolved Tactics: Hiding in Plain Sight With Resource Files
Executive Summary This article examines new obfuscation techniques the Gremlin stealer malware uses to conceal malicious payloads within embedded resources. We analyze a variant protected…
Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution
Executive Summary On May 6, 2026, Palo Alto Networks released a security advisory for CVE-2026-0300, identifying a buffer overflow vulnerability in the User-ID Authentication Portal…
Essential Data Sources for Detection Beyond the Endpoint
The 2026 Unit 42 Global Incident Response Report delivers a sharp wake-up call: Threat actors are now moving 4x faster to exfiltration than in 2025.…