[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) ![CATEGORY](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/01_General_Overview_1920x900.jpg) SEP 29TH, 2025 # Unit 42 Threat Bulletin -- September 2025 September is here, bringing a packed edition of the Unit 42 Threat Bulletin. Expect new content and expert perspectives in each issue. [Intel and Insights](#section-1 "Intel and Insights Dropdown") ![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * [Intel and Insights](#section-1 "Intel and Insights") * [CISO Unscripted](#section-2 "CISO Unscripted") * [Threat Vector](#section-3 "Threat Vector") * [Behind the Intelligence](#section-4 "Behind the Intelligence") September is here, bringing a packed edition of the Unit 42 Threat Bulletin in a fresh new format. As the cyber threat landscape continues to evolve, we will share new content and expert perspectives with every issue. I'm Mitch Mayne, Editor in Chief of the Threat Bulletin and Cybersecurity Research Principal for Unit 42. This month, we spotlight the surge in payroll account takeover attacks and reveal how attackers are seizing employee paychecks as a potential gateway to broader network compromise. You'll also find a candid video where I meet with Wendi Whitmore, Chief Security Intelligence Officer, to discuss why AI instances may be becoming the newest insider threat. Finally, we examine an aggressive SEO poisoning campaign targeting trusted government and enterprise organizations--showcasing how attackers are hijacking user search traffic to spread scams and malware. Let's get into it. ![author image](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/Mitch-Insights-1.png) Mitch Mayne, Principal, Security Research Get the monthly Unit 42 Threat Bulletin. Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ## Intel and Insights Get the Unit 42 perspective on how attackers are exploiting employer accounts in third‑party payroll platforms to reroute employee paychecks in our exclusive interview with Margaret Kelley. *Mitch Mayne: We're seeing a unique attack pattern emerge that targets an employee's payroll information to redirect their direct deposit to the attacker's account. Margaret, could you break down how this attack works?* **Margaret Kelley:** The attacker's goal is to change the employee's direct deposit information from inside the employee's payroll account. They usually call the helpdesk, impersonate the employee, and rely on basic personal details like addresses, birthdays, manager's name---information that can often be found through open sources or social media. From there, they convince the helpdesk to reset the password and MFA, then log in to change payroll information. *MM: This seems pretty unsophisticated compared to some tactics we see. I mean, it only works once per employee, because they notice when they get locked out of their account or don't get paid, right?* **MK:** Exactly. And that simplicity is part of what makes it effective. The attacker only needs a few minutes to succeed. We've seen the same voice on multiple helpdesk calls. They hide behind VPNs, and once inside, they monitor the victim's inbox to delete any password or MFA change notifications before the employee notices. *MM: How worried should organizations be about this attack type? How can they guard against it?* **MK:** For CISOs, the real takeaway is that these incidents highlight weaknesses in identity and access governance. Leaders should ensure helpdesk staff have clear and enforceable validation standards that go beyond publicly searchable data. Organizations should review what employees share online, such as badge photos, which can give attackers an advantage. From a detection standpoint, think about systemic signals---clusters of MFA resets in a short window, a shift in devices used for authentication, or logins from non‑approved VPN providers. These are indicators security teams can use to spot and stop this early. ![author](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/fillertry.png) Margaret Kelley, Principal Consultant [Read more by Margaret Kelley](http://unit42.paloaltonetworks.com/author/margaret-kelley/) Video ## CISO Unscripted Unit 42's Mitch Mayne talks with Palo Alto Networks' Chief Security Intelligence Officer, Wendi Whitmore, about how AI instances are now the newest insider threat targeted by attackers within organizations. We discuss how adversaries are leveraging AI to accelerate and amplify cyberattacks, and I share clear steps security leaders can take to safeguard both their data and the AI systems shaping their business. ![poster image](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/CISO-Unscripted-No-Play-Button-1200x628-1.jpg) "The best way to use a board, most often, is as thought partners --- allowing them to ask the hard questions, challenge your thinking, satisfy themselves that you've really thought through all the possibilities and can figure out what are the more likely and higher impact ones... and which ones don't deserve discussion at the board level." \--- Abby Alderman, CEO, Boardspan Podcast ## Threat Vector [![apple](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/apple-podcast.svg)](https://podcasts.apple.com/us/podcast/threat-vector-by-palo-alto-networks/id1725324656) [![rss feed](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/rss-feed.svg)](https://feeds.megaphone.fm/unit42threatvector) [![spotify](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/spotify.svg)](https://open.spotify.com/show/676BEZwcsufFf620HdzbUo) [![youtube](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/youtube.svg)](https://www.youtube.com/playlist?list=PLqATPiC_Bcl9U_7PyEdRC_DowIz3d33oj) [![overcast](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/overcast.svg)](https://overcast.fm/itunes1725324656/threat-vector-by-palo-alto-networks) ![podcast default icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/podcast-icon-white.svg) ![podcast default icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/podcast-icon-white.svg) Communicating Cyber Risk Effectively to Your Board Seek Slider 15s 30s volume-slider *00:00* *00:00* ## Behind the Intelligence We spoke with Palo Alto Networks threat researcher Yoav Zemah about a recently uncovered, targeted campaign where a Chinese-speaking group compromises web servers--including government portals--to execute wide-scale search engine manipulation, known as SEO poisoning. *Mitch Mayne: What should we know at a glance?* **Yoav Zemah:** This campaign targets trusted public-facing sites, including those belonging to government agencies and large enterprises. Attackers break in and alter web traffic so that normal users searching for common keywords are redirected to fraudulent sites, where they may be exposed to scams or malware. Users must realize that any internet-exposed web system is at risk, regardless of how well-known or "safe" the brand appears. *MM: What makes this attack stand out?* **YZ:** The real differentiator here is strategic scale and impact. This threat actor targets dozens of legitimate, high-value websites simultaneously, leveraging their reputation to hijack user trust and amplify the reach of their scam sites. By manipulating trusted brands and public institutions, the operators undermine stakeholder confidence and can inflict significant reputational and operational damage. The fact that the underlying code adapts to local search engines indicates careful planning and a focus on maximizing effectiveness in specific regions. *MM: What should CISOs take away from this research?* **YZ:** This campaign demonstrates a move toward more professionalized and persistent web server attacks. I predict attackers will further customize and expand these campaigns going forward, selling access and targeting additional segments. Security leaders should ensure that teams are actively monitoring for unusual web traffic patterns, including unauthorized redirects, and aggressively investigating any signs of malware "calling home" to external servers. **YZ:** Further, it is essential to educate employees and end users about safe browsing habits, specifically urging them to use direct links or bookmarks for login portals and other sensitive destinations, rather than relying on internet search results. ![author](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/fillertry-copy-yoav-2.png) Yoav Zemah, Senior Threat Researcher [Read more by Yoav Zemah](https://unit42.paloaltonetworks.com/author/yoav-zemah/) × Get the Unit 42 Threat Intel Bulletin First Name Last Name Business Email Company Job Level Job level Job Role Select a job function Phone Country Country State State Province Province Zip Code Department Sign me up to receive news, product updates, sales outreach, event information and special offers about Palo Alto Networks and its partners. By submitting this form, I understand my personal data will be processed in accordance with [Palo Alto Networks Privacy Statement](https://www.paloaltonetworks.com/content/pan/en_US/legal-notices/privacy.html) and [Terms of Use.](https://www.paloaltonetworks.com/content/pan/en_US/legal-notices/terms-of-use.html) This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Subscribe #### THANK YOU! A Palo Alto Networks specialist will reach out to you shortly. We look forward to connecting with you! ## Previous Bulletins ![Pictorial representation of the ARC OT lab.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/1A_unit-42_ARC_web_hero_desktop_1920x900-786x368.jpg) June, 2026 [#### OT Threat Research](https://unit42.paloaltonetworks.com/threat-bulletin/ot-threat-research-arc/) * [Operational Technology](https://unit42.paloaltonetworks.com/tag/operational-technology/ "Operational Technology") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-bulletin/ot-threat-research-arc/ "OT Threat Research") ![Pictorial representation of a BadSuccessor attack. A person analyzing data on a computer screen in a busy office environment, with digital graphs and code overlaying the image.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/04_Security-Technology_Category_1920x900-786x368.jpg) May, 2026 [#### Unit 42 Threat Bulletin - May 2026](https://unit42.paloaltonetworks.com/threat-bulletin/may-2026/) [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-bulletin/may-2026/ "Unit 42 Threat Bulletin - May 2026") ![Pictorial representation of hands typing on a keyboard.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/01_Opinion_Overview_1920x900-786x368.jpg) April, 2026 [#### Unit 42 Threat Bulletin - April 2026](https://unit42.paloaltonetworks.com/threat-bulletin/april-2026/) [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-bulletin/april-2026/ "Unit 42 Threat Bulletin - April 2026") ![Pictorial representation of Airstalk malware. A person typing on a laptop with digital graphics of binary code and light beams emanating from the screen, representing data transfer or cyber activity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/07_Security-Technology_Category_1920x900-786x368.jpg) March, 2026 [#### Unit 42 Threat Bulletin - March 2026](https://unit42.paloaltonetworks.com/threat-bulletin/march-2026/) [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-bulletin/march-2026/ "Unit 42 Threat Bulletin - March 2026") ![Pictorial representation of a man with glasses viewing a monitor of code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/03_Interview_Category_1505x922-718x440.jpg) February, 2026 [#### Unit 42 Threat Bulletin - February 2026](https://unit42.paloaltonetworks.com/threat-bulletin/february-2026/) [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-bulletin/february-2026/ "Unit 42 Threat Bulletin - February 2026") ![Pictorial representation of an interview between two individuals containing a microphone, their hands, a wooden table, and a white brick wall.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/01_Interview_Category_1505x922-718x440.jpg) November, 2025 [#### Unit 42 Threat Bulletin -- November 2025](https://unit42.paloaltonetworks.com/threat-bulletin/november-2025/) [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-bulletin/november-2025/ "Unit 42 Threat Bulletin – November 2025") ![Pictorial representation of a smiling woman on her phone set against a dark background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/03_Opinion_Category_1505x922-718x440.jpg) October, 2025 [#### Unit 42 Threat Bulletin - October 2025](https://unit42.paloaltonetworks.com/threat-bulletin/october-2025/) [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-bulletin/october-2025/ "Unit 42 Threat Bulletin - October 2025") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) UNIT42 THREAT BULLETIN ## Get this newsletter in your inbox Subscribe {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)