Posts created by: Yuchen Zhou

At Palo Alto Networks, we use various methods to detect malicious web pages and malicious JavaScript on websites our customers visit online. In addition to static approaches such as signature matching, our security crawlers execute all scripts discovered on web pages and observe their dynamic behavior.

Unit 42 examines how using machine learning-based techniques can discover new threats and block them before they can affect our customers.

Unit 42 examines the pervasiveness of unauthorized coin mining inside browsers.

Exploit Kits (EK), arguably the most impactful malicious infrastructure on the Internet, constantly evolve to evade detection by security technology. Tremendous effort has been spent on tracking new variations of different EK families. In this report, we look at an EK from an operational point of view. Specifically, we have been tracking the activity of

Note: This post was updated on November 18, 2015 to reflect new information about the initial discovery of the injected code. On November 3, 2015, ZScaler reported that a Chinese government website hosting the Chuxiong Archives, www.cxda[.]gov.cn, had been compromised and contained injected code leading to the Angler Exploit Kit. The compromise was apparently remediated