Logo
Unit42 Logo
  • Tools
  • ATOMs
  • Security Consulting
  • About Us
  • Under Attack?
Pictorial representation of Russian global webmail espionage campaign. A digital illustration of a world map in a network style, highlighting continents with glowing lines and connectivity points in a red and blue theme.
 category iconThreat Research July 23, 2026

Russian Global Webmail Espionage

Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials.

  • CL-STA-1114
  • JavaScript
  • Javascript injection
Read now
Pictorial representation of three zero-day vulnerabilities in Siemens ROX II OT switches. Digital illustration of a global network featuring interconnected lines and nodes over a map of the world, highlighted with neon lights and digital elements.
 category iconThreat Research July 17, 2026

Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

  • Command injection
  • CVE-2025-40947
  • CVE-2025-40948
Read now
Pictorial representation of a female smiling while looking at the screen of a tablet. The backgorund is dark and features warm-toned lights.
 category iconInsights July 16, 2026

AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report

  • AI
  • LLM
  • Unit 42 Incident Response Report
Read now
Pictorial representation of the npm packages supply chain attack. Screen displaying code with a prominent alert symbol and the words 'VIRUS DETECTED' highlighted in red.
 category iconHigh Profile Threats July 15, 2026

The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)

  • Credential Harvesting
  • GitHub
  • Npm packages
Read now
 category iconThreat Research July 15, 2026

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

  • C2
  • DGA
  • Docker compose
Read now
A board room against a backdrop of windows showing a cityscape.
 category iconInsights July 10, 2026

No Manners Here: The Ruthless Rise of The Gentlemen Ransomware

  • Howling Scorpius
  • RaaS
  • Spikey Scorpius
Read now
Pictorial representation of Vidar Stealer. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise.
 category iconThreat Research July 7, 2026

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

  • AMSI
  • Cryptocurrency
  • DLL Sideloading
Read now
Pictorial representation of WebAuthn. A person wearing glasses with computer code reflected in the lenses. The focus is on the eye, and the code is clear and detailed.
 category iconInsights July 2, 2026

How We Added WebAuthn to a Browser-Based RDP Client

  • IDA Pro
  • Microsoft
  • RDP
Read now
Pictorial representation of Phantom Squatting. A dynamic wave pattern composed of blue and red particles on a dark background, symbolizing data flow or connectivity.
 category iconThreat Research June 30, 2026

Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector

  • Agentic AI
  • LLMs
  • Malicious Domains
Read now
Pictorial representation of large-scale credential attacks. A vibrant city skyline at night, with tall skyscrapers and glowing digital beams extending into the sky, suggesting advanced technology and connectivity.
 category iconHigh Profile Threats June 26, 2026

Threat Brief: Mitigating Large-Scale Credential Attacks

  • Credential theft
Read now
Pictorial representation of CL-STA-1062 targeting energy and government sectors in Southeast Asia. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen, indicating malware.
 category iconThreat Research June 25, 2026

CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure

  • Backdoor
  • CL-STA-1062
  • Malware
Read now
Pictorial representation of OpenClaw's skill marketplace and AI supply chain risk. A bustling city street at dusk, filled with silhouettes of pedestrians. The scene is illuminated by glowing lights from buildings and a warm, golden sky, creating a vibrant, almost dream-like atmosphere.
 category iconThreat Research June 23, 2026

OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat

  • Agentic AI
  • ClawHavoc
  • ClawHub
Read now
Pictorial representation of bucket hijacking technique for cloud data exfiltration. Digital illustration of Europe map highlighting network connections and nodes, depicted as glowing points and lines on a dark blue background, emphasizing major cities and connectivity across the continent.
 category iconThreat Research June 22, 2026

The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration

  • AWS
  • Bucket hijacking
  • Cloud data exfiltration
Read now
Loader icon View more
Newsletter
UNIT 42 Small Logo Get updates from Unit 42

Peace of mind comes from staying ahead of threats. Subscribe today.

Subscribe for email updates to all Unit 42 threat research.
By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Invalid captcha!

Get the latest news, invites to events, and threat alerts

By submitting this form, I understand my personal data will be processed in accordance with Palo Alto Networks Privacy Statement and Terms of Use.

Products and Services
  • AI-Powered Network Security Platform
  • Secure AI by Design
  • Prisma AIRS
  • AI Access Security
  • Cloud Delivered Security Services
  • Advanced Threat Prevention
  • Advanced URL Filtering
  • Advanced WildFire
  • Advanced DNS Security
  • Enterprise Data Loss Prevention
  • Enterprise IoT Security
  • Medical IoT Security
  • Industrial OT Security
  • SaaS Security
  • Next-Generation Firewalls
  • Hardware Firewalls
  • Software Firewalls
  • Strata Cloud Manager
  • SD-WAN for NGFW
  • PAN-OS
  • Panorama
  • Secure Access Service Edge
  • Prisma SASE
  • Application Acceleration
  • Autonomous Digital Experience Management
  • Enterprise DLP
  • Prisma Access
  • Prisma Browser
  • Prisma SD-WAN
  • Remote Browser Isolation
  • SaaS Security
  • AI-Driven Security Operations Platform
  • Cloud Security
  • Cortex Cloud
  • Application Security
  • Cloud Posture Security
  • Cloud Runtime Security
  • Prisma Cloud
  • AI-Driven SOC
  • Cortex XSIAM
  • Cortex XDR
  • Cortex XSOAR
  • Cortex Xpanse
  • Unit 42 Managed Detection & Response
  • Managed XSIAM
  • Next-Generation Identity Security
  • Privileged Access Management
  • Identity and Access Management
  • Endpoint Privilege Manager
  • Identity Governance
  • Workforce Password Management
  • Agentic Identities
  • Secrets Management
  • Unified Secrets Governance
  • Application Credentials Delivery
  • Vendor Privileged Access
  • Threat Intel and Incident Response Services
  • Proactive Assessments
  • Incident Response
  • Transform Your Security Strategy
  • Discover Threat Intelligence
Company
  • About Us
  • Careers
  • Contact Us
  • Corporate Responsibility
  • Customers
  • Investor Relations
  • Location
  • Newsroom
Popular Links
  • Blog
  • Communities
  • Content Library
  • Cyberpedia
  • Event Center
  • Manage Email Preferences
  • Products A-Z
  • Product Certifications
  • Report a Vulnerability
  • Sitemap
  • Tech Docs
  • Unit 42
  • Do Not Sell or Share My Personal Information
Palo Alto Networks Logo
  • Privacy
  • Trust Center
  • Terms of Use
  • Documents

Copyright © 2026 Palo Alto Networks. All Rights Reserved

  • Youtube
  • Podcast
  • Facebook
  • LinkedIn
  • Twitter
  • Select your language
    Your browser does not support the video tag.

    Default Heading

    Read the article Right Arrow