How We Added WebAuthn to a Browser-Based RDP Client
The Pitch TL;DR: We built the first RDP client outside of Windows to support WebAuthn redirection, beating Microsoft’s own macOS, iOS and Linux clients to…
Category: Unit42
![Unit 42 observed an initial access broker (IAB) on the Russian-language cybercrime forum Exploit[.]in claiming responsibility for this campaign of large-scale credential attacks, referencing a CVE (no further information), and offering the harvested credentials for sale on June 16, 2026. Unit 42 has not validated their claims at this time.](https://image.cybernoz.com/wp-content/uploads/2026/06/Threat-Brief-Mitigating-Large-Scale-Credential-Attacks-600x340.png)
Threat Brief: Mitigating Large-Scale Credential Attacks
Unit 42 is aware of a large-scale password spraying and credential theft campaign (“FortiBleed”) against Fortinet devices. We observed attempts targeting MSSQL devices as well,…
Trust No Skill: Integrity Verification for AI Agent Supply Chains
Executive Summary AI agents now extend their capabilities by installing third-party skills the way smartphones install apps. Anyone can publish a skill to a public…
When “Hi, This Is IT” Comes Through Microsoft Teams
“Hi, IT Department Here!” It’s Friday afternoon. The week has been busy, and everyone is wrapping up before the weekend. One of your workers receives…
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw…
Out of the Crypt: The Evolving Cyber Extortion Economy
Extortion Activity No Longer Requires Encryption for Payment This blog dives into the growing trend of data theft and extortion activities which no longer require…
Gremlin Stealer’s Evolved Tactics: Hiding in Plain Sight With Resource Files
Executive Summary This article examines new obfuscation techniques the Gremlin stealer malware uses to conceal malicious payloads within embedded resources. We analyze a variant protected…
Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution
Executive Summary On May 6, 2026, Palo Alto Networks released a security advisory for CVE-2026-0300, identifying a buffer overflow vulnerability in the User-ID Authentication Portal…
Essential Data Sources for Detection Beyond the Endpoint
The 2026 Unit 42 Global Incident Response Report delivers a sharp wake-up call: Threat actors are now moving 4x faster to exfiltration than in 2025.…
TGR-STA-1030: New Activity in Central and South America
TGR-STA-1030 remains an active threat. Since February, we have observed widespread activity from this group across multiple countries. Most recently, their efforts appear to be…
Frontier AI and the Future of Defense: Your Top Questions Answered
Over the last several weeks, Palo Alto Networks and Unit 42 have been talking with CISOs and security leaders globally to discuss the emergence of…
Cracks in the Bedrock: Agent God Mode
Executive Summary Our first article about the boundaries and resilience of Amazon Bedrock AgentCore focused on the Code Interpreter sandbox, and how it can be…