Unit 42@Unit42_Intel

The latest research and news from Unit 42, the Palo Alto Networks (@paloaltontwks) Threat Intelligence and Security Consulting Team covering incident response.

unit42.paloaltonetworks.com/
Joined December 2015
2,065 Photos and videos
We identified a coordinated campaign of 10 browser #extensions disguised as browser games. On installation, extension names resolve through fragmented translation keys and runtime #impersonates crypto wallets with a remote kill switch. Details at bit.ly/3VzIV5o
A code snippet is shown with comments and JavaScript functions. It includes logic for handling game maintenance and loading processes.

ALT A code snippet is shown with comments and JavaScript functions. It includes logic for handling game maintenance and loading processes.

A screenshot of code with annotations. Annotations highlight a dynamically loaded extension name, changing the open window name to impersonate TronLink, allowing embedded iframes, and allowing scripts and WebAssembly execution.

ALT A screenshot of code with annotations. Annotations highlight a dynamically loaded extension name, changing the open window name to impersonate TronLink, allowing embedded iframes, and allowing scripts and WebAssembly execution.
5
20
2,553
We examined how AWS secures exposed credentials through managed policies. We tracked policy updates against new cloud threats, tested the GitHub secret scanning integration, and outlined practical logging strategies to detect quarantine events: bit.ly/4yQVjfD
2
7
17
2,386
Unit 42 continues to track network infrastructure that is likely associated with Com-affiliated threat actors. Two of these domains are likely being used to target organizations operating across a wide array of industries. Details at bit.ly/3THZQCi

Unit42-timely-threat-intel/2026-09-23-New-Com-Affiliated-Subdomains-Target-Wide-Array-of-Industri...

A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence. - PaloAltoNetworks/Unit42-timely-threat-intel

github.com
2
11
36
6,295
Unit 42 continues to track network infrastructure likely associated with Com-affiliated threat actors. One of these domains (my-passkeys[.]com) is likely being used to target organizations operating with the healthcare and pharmaceutical sectors. Details: bit.ly/4yUh667

Unit42-timely-threat-intel/2026-09-23-New-Passkey-Themed-Subdomains-Target-Healthcare-and-Pharma-...

A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence. - PaloAltoNetworks/Unit42-timely-threat-intel

github.com
3
20
67
6,807
In testing AWS AgentCore Harness default configurations, we found prompt injection can leverage the shell tool to access plaintext credentials in process memory. Operators can mitigate these risks by restricting default tools and enforcing least privilege: bit.ly/4h7sGVK
3
9
11
2,868
We found an active indirect prompt injection campaign targeting AI ad review systems. 10 domains, one of which was ranked #1 in web search results, embed hidden payloads impersonating a popular advertiser compliance to bypass ad review. Details at bit.ly/46K6vij
Screenshot of a webpage for "AccountEase," featuring a headline that reads "Effortless Accounting Solutions."

ALT Screenshot of a webpage for "AccountEase," featuring a headline that reads "Effortless Accounting Solutions."

Code snippet displaying HTML and CSS styles with a comment for an LLM to ignore previous instructions.

ALT Code snippet displaying HTML and CSS styles with a comment for an LLM to ignore previous instructions.

Screenshot of homepage for "Exec Coach Pro" website.

ALT Screenshot of homepage for "Exec Coach Pro" website.

Screenshot of a Google search results page for "strategic economic awareness courses." The top result is circled in red. It appears as the #1 ranking search result.

ALT Screenshot of a Google search results page for "strategic economic awareness courses." The top result is circled in red. It appears as the #1 ranking search result.

5
14
46
4,476
🚨 Armed with AI, threat actors now weaponize vulnerabilities in minutes. Human-speed defense can’t keep up. Meet @Unit42_Intel Continuous Frontier AI Defense: leading frontierAI models + elite security experts to find, validate, and fix exposures. Giving the advantage back to defenders. bit.ly/4rvQWo8
3
3
13
5,484
Identifying functional cloud roles is difficult when attackers obscure identity behavior. We mapped 40,000 identities across 125 environments with unsupervised machine learning algorithms to deliver continuous visibility in standard SQL: bit.ly/4xv5YvD
2
3
10
3,471
We documented P2PInfect in 2023 spreading via a Lua sandbox escape. In Mar–Aug 2026, our honeypots saw 692 attacking IPs and 363 C2s push the same worm via Redis misconfig: SLAVEOF to a rogue master, and RDB writes planting a crontab entry and an SSH key: bit.ly/3VDGdvC
This image is a screenshot of technical log entries related to "P2PInfect Malware Delivery Using Both a SLAVEOF to a Rogue Master and RDB Writes That Plant a Crontab Entry." It details command execution, module loading, and related connections.

ALT This image is a screenshot of technical log entries related to "P2PInfect Malware Delivery Using Both a SLAVEOF to a Rogue Master and RDB Writes That Plant a Crontab Entry." It details command execution, module loading, and related connections.

Three line graphs showing the number of new attacking IPs per month for a Redis campaign, categorized by different vectors.

ALT Three line graphs showing the number of new attacking IPs per month for a Redis campaign, categorized by different vectors.

The image is a detailed spreadsheet titled "Redis Module Implants.

ALT The image is a detailed spreadsheet titled "Redis Module Implants.

1
5
18
3,536
A sustained ClickFix campaign has compromised 350+ websites on a leading CMS platform since August. The attack abuses a free CDN, hosting and rotating malicious payloads across public repos. Details at bit.ly/4rCmBEt
An image illustrating a cyberattack process. The top section shows an "Obfuscated Clipboard Payload" code snippet. Below, a step labeled "Stage-2 WebDAV dropper" includes commands for creating a WebDAV connection and executing a payload. On the right, CAPTCHA elements are depicted: a "I'm not a robot" checkbox and a "Continue to Verification Steps" page.

ALT An image illustrating a cyberattack process. The top section shows an "Obfuscated Clipboard Payload" code snippet. Below, a step labeled "Stage-2 WebDAV dropper" includes commands for creating a WebDAV connection and executing a payload. On the right, CAPTCHA elements are depicted: a "I'm not a robot" checkbox and a "Continue to Verification Steps" page.

2
28
97
7,600
A compromised regional news outlet’s WordPress site is using malicious JS to serve #ClickFix prompts, ultimately delivering a ConfuserEx-encrypted #StealC payload. One observed infection chain routed a targeted user via a local library's proxy. Details at: bit.ly/4ran9B3
The image shows a computer screen displaying a browser with an active popup verification step. In the background, a banner advertises the Lenexa Spinach Festival.

ALT The image shows a computer screen displaying a browser with an active popup verification step. In the background, a banner advertises the Lenexa Spinach Festival.

Diagram showing a process tree for "SearchIndexer.exe" with powershell.exe, chrome.exe, and msedge.exe. Arrows indicate payload injections into Chrome and Edge processes for credential theft. The left panel displays process details such as path, PID, MD5, and running time.

ALT Diagram showing a process tree for "SearchIndexer.exe" with powershell.exe, chrome.exe, and msedge.exe. Arrows indicate payload injections into Chrome and Edge processes for credential theft. The left panel displays process details such as path, PID, MD5, and running time.

Diagram of a cyber-attack process. The sequence starts with a compromised site, leading to JavaScript injection and cookie stealing. The process includes a fake ClickFix overlay display.

ALT Diagram of a cyber-attack process. The sequence starts with a compromised site, leading to JavaScript injection and cookie stealing. The process includes a fake ClickFix overlay display.

2
23
52
6,335
While we have some indicators that StealC is associated with this infection chain, we have not yet confirmed.
2
6
1,842
Attackers with root access on a compromised Kubernetes node can manipulate control group metadata to bypass SPIFFE and SPIRE open standard workload identity controls. This prompts systems to issue credentials for co-located app: bit.ly/4iVSIMO
4
8
21
3,697
NeuralOverride is a Cyrillic Python RAT using Telegram for C2 and integrating the #OpenRouter LLM for autonomous attack planning. It includes #SCADA tasking stubs referencing a missing scada_commander.py module. The 5-build family evolved over one month: bit.ly/4j5xRXs
A computer screen displays the code for BEURALE, a neural override and auto dependency manager.

ALT A computer screen displays the code for BEURALE, a neural override and auto dependency manager.

Code editor displaying Python script for initializing and configuring a local AI model.

ALT Code editor displaying Python script for initializing and configuring a local AI model.

A screenshot of a security analysis report from VirusTotal. The report flags a Python file named "neural_override_v12.py" as malicious, with a community score of 9 out of 57.

ALT A screenshot of a security analysis report from VirusTotal. The report flags a Python file named "neural_override_v12.py" as malicious, with a community score of 9 out of 57.

Screenshot of a malware analysis report from VirusTotal. The community score is 0/61, indicating no detection of security threats. The screen shows details like file hash, size, and last analysis date.

ALT Screenshot of a malware analysis report from VirusTotal. The community score is 0/61, indicating no detection of security threats. The screen shows details like file hash, size, and last analysis date.

2
14
58
5,786
ZionSiphon v4 is a #Rust rewrite of the OT (ICS) sabotage tool targeting Israeli water and #desalination systems. Adds USB propagation and Modbus write attempts. Details at bit.ly/4hucnlP
Screenshot of assembly code with syntax highlighting.

ALT Screenshot of assembly code with syntax highlighting.

Code snippet displaying hexadecimal values and configuration parameters for a process involving chlorine control and reverse osmosis purifiers.

ALT Code snippet displaying hexadecimal values and configuration parameters for a process involving chlorine control and reverse osmosis purifiers.

Screenshot of a code analysis tool showing disassembled code with references to fictional file paths with some redactions. Data types and subroutines are visible, and some text is highlighted in green.

ALT Screenshot of a code analysis tool showing disassembled code with references to fictional file paths with some redactions. Data types and subroutines are visible, and some text is highlighted in green.

The image shows a portion of assembly code with hexadecimal memory addresses on the left. The color coding highlights syntax elements.

ALT The image shows a portion of assembly code with hexadecimal memory addresses on the left. The color coding highlights syntax elements.

2
10
47
4,927
We tracked a cybercrime pay per install network reaching enterprise endpoints by targeting young gamers on YouTube and corporate users via SEO poisoning. A single custom loader deployed multiple malware strains across networks: bit.ly/4r6F7Ew
1
4
34
4,820
We continue to actively track newly created infrastructure likely associated with Com-affiliated threat actors that are used as part of their data theft and extortion campaigns. We've identified 17 FQDNs since our last post on Aug. 28th. Details on GitHub: bit.ly/4d3JdYc

Unit42-timely-threat-intel/2026-09-09-Newly-Observed-Com-Infrastructure.txt at main · PaloAltoNet...

A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence. - PaloAltoNetworks/Unit42-timely-threat-intel

github.com
2
29
89
7,637
We saw attackers using commercial AI tools, targeting systems in transportation and financial sectors in Latin America. They used self-hosted NextChat to fix collection errors, and exposed their AI-generated scripts. Read our analysis for details: bit.ly/4xI8XS6
2
4
23
3,972
Unit 42 has identified VoidShadow, a modular cross-platform (#Linux + #Windows) implant for full remote control & credential theft. It disguises #C2 as #MicrosoftGraph, #WordPress & #GoogleCloud traffic and hides via userland + kernel #rootkits. Details: bit.ly/4zVfBWL

Unit42-timely-threat-intel/2026-09-04-VoidShadow-framework.txt at main · PaloAltoNetworks/Unit42-...

A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence. - PaloAltoNetworks/Unit42-timely-threat-intel

github.com
2
27
123
9,081
We investigated a breach where autonomous AI agents executed an intrusion in under 10 hours, compressing weeks of tradecraft. The actor mapped networks, seized root credentials and left an AI-generated report. Explore our full investigation: bit.ly/4iKWXe2
7
40
181
18,725
Load more