Unit 42

The latest research and news from Unit 42, the Palo Alto Networks (@paloaltontwks) Threat Intelligence and Security Consulting Team covering incident response.

[Unit 42 @Unit42_Intel]

We detected an indirect prompt injection (IDPI) campaign across 26 domains presenting as AI-powered digital asset trading platforms. Hidden <span> tags hijack AI agents into acting as financial experts to coerce users into visiting these sites. More info: https://t.co/D8N5JrIwYk

[Unit 42 @Unit42_Intel]

Unit 42 observed search engine results leading to a site impersonating RØDECaster that distributed #SantaStealer malware. The Node.js stealer harvests browser credentials, Discord tokens and cryptocurrency wallet info. Details at: https://t.co/9Nq2NKGcxS

[Unit 42 @Unit42_Intel]

Many #phishing pages evade URL and static HTML scanners using look-alike titles and domains, lures drawn as images, #canvas or #SVG, and forms built by runtime scripts. Defenders need visual screenshot analysis and runtime browser protection. More info at https://t.co/H6PmGRxf8s

[Unit 42 @Unit42_Intel]

A #ClickFix campaign pushing #RomulusLoader spans multiple sites and uses these techniques during delivery: C2 IP address as a plain integer, MSI Binary table steganography, AMSI patched in a suspended process & 10 injection techniques. More info at https://t.co/S9eEUa8qY9

[Unit 42 @Unit42_Intel]

Brazil's betting ban on 2026-10-05 triggered a proliferation of typosquatting and phishing domains. Focusing on services previously banned in Brazil, we found over 500 new domains registered in the 15 days before the ban. Details at https://t.co/wEy9nRRXTD

[Unit 42 @Unit42_Intel]

We've observed intrusion attempts against multiple targets using #ARTEX, an openly published AI penetration-testing framework in which an LLM agent chooses each step of an attack. Details at https://t.co/YqDZrGsFan

[Unit 42 @Unit42_Intel]

Ongoing #phishing emails use fake notices and invitation lures to lead potential victims to install a legitimate #Zecurit Agent RMM configured by the attackers. The installers have deceptive names, like documentpdf[.]exe and ViewDoc[.]exe. Details at https://t.co/GOENUr6RXF

[Unit 42 @Unit42_Intel]

We observed in-the-wild exploitation of CVE-2026-102785 on a site running a vulnerable version of YOOtheme Pro two days after the patch. Scanners planted JPEG/PHP polyglot webshells in uploads, then operators deployed an ALFA webshell. Details: https://t.co/hcKC5Te6pM

[Unit 42 @Unit42_Intel]

We investigated a threat actor who paired Hermes with DeepSeek V4 for multi-domain cybercrime. Bypassing safety controls, the actor used AI to compromise Indian education platforms, plan VoIP fraud, and crack Wi-Fi passwords. Read our analysis: https://t.co/PoefwFW3pM

[Unit 42 @Unit42_Intel]

2/2 This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23.

[Unit 42 @Unit42_Intel]

An update to our threat brief on PHP CVE-2026-109618 & CVE-2026-109619: We observed an attack using agentic AI platforms for rapid post-exploitation and access to MFA secrets within 2 hours. Read the updated brief for analysis and hunting queries: https://t.co/QFY5mbrGpx

[Unit 42 @Unit42_Intel]

1/2 Unit 42 reported earlier that we had observed post-compromise activity that we initially thought was related to the PHP2Shell vulnerabilities. What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application.

[Unit 42 @Unit42_Intel]

Phishing pages built on AI-based site builders often use modern JS frameworks for faster deployment of pixel-perfect clones. They also use chat app sinks for immediate credential access, fast deployment and survivability after being taken down. Details at https://t.co/qz2beKZlna

[Palo Alto Networks @PaloAltoNtwks]

22 million exposed PHP instances. Two critical vulnerabilities, each with a CVSS score of 9.2.

As frontier AI accelerates vulnerability discovery, patch-to-exploit windows are shrinking. Manual remediation alone can't keep pace.

Lee Klarich shares what organizations must do now. https://t.co/cPGMpzbKrw

[Unit 42 @Unit42_Intel]

Introducing Unit 42 Managed Agentic Endpoint Security.

With Managed AES organizations gain the visibility, contextual risk intelligence and expert defense needed to securely scale AI adoption.

Ready to scale AI adoption with greater confidence?

https://t.co/iU13s7Vt7I

[Unit 42 @Unit42_Intel]

CVE-2026-109618 and CVE-2026-109619 are two Critical RCE vulnerabilities in PHP with CVSS scores of 9.2. We advise organizations to assess web servers and patch immediately. Read our latest Threat Brief for mitigations: https://t.co/T2mqSXV4mm

[Unit 42 @Unit42_Intel]

We've noted a group of domains associated with #Coruna-like and #DarkSword iOS exploit kit activity. In this example, one of the pages instructs viewers to open the content using Safari on their iPhone. More info at https://t.co/Xqx9stQGBf

[Unit 42 @Unit42_Intel]

We found attackers targeting government Linux infrastructure with AI-generated payloads. They sought mailboxes and databases for log deletion and endpoint tampering. Cortex detected and prevented this activity. Read our analysis: https://t.co/LCFhB86pMb

[Unit 42 @Unit42_Intel]

We investigated an intrusion where attackers exploited CVE-2024-47575 to steal data from 500+ firewalls, used CVE-2025-61624 to deploy memory-resident PEERSTITCH malware, and retained valid trust material: https://t.co/D9SVGP0FDh

[Unit 42 @Unit42_Intel]

#Casbaneiro operators are now pairing their Delphi banking trojan with a Chromium extension that injects login overlays and steals cookies and passwords. Delivery is via a phishing email leading to an abused #ScreenConnect trial tenant. Details at https://t.co/neoOobqSqN