Unit 42

The latest research and news from Unit 42, the Palo Alto Networks (@paloaltontwks) Threat Intelligence and Security Consulting Team covering incident response.

[Unit 42 @Unit42_Intel]

Unit 42 provides indicators of activity and mitigations for PAN-OS CVE-2026-0257, an authentication bypass in GlobalProtect. https://t.co/fKkirRgJVm

[Unit 42 @Unit42_Intel]

We detected an evasive #ClickFix injection with a fake Lirunex payment platform lure tricking the user into requesting the SSL certificate path through a file dialog box but silently delivers a RAT disguised as image files. Details at https://t.co/3gOKYWrMLz

[Unit 42 @Unit42_Intel]

FlutterShell is a new macOS backdoor spread by malvertising. Built with Flutter, it uses a WebView-based architecture for adware, allowing attackers to remain dynamic. We discuss its evolution, variants and command structure in a recent campaign. https://t.co/7dUEPypRIn

[Unit 42 @Unit42_Intel]

We are tracking Pink (CL-CRI-1147), a new Com-affiliated extortion brand whose leak site went live 5/31/26. Pink uses vishing and IT impersonation to phish credentials/MFA, then exfiltrates enterprise cloud storage and productivity data to extort victims: https://t.co/gyaGA1iG1S

[Unit 42 @Unit42_Intel]

An update to our Threat Brief on npm supply chain attacks discusses the latest compromise, pushing a payload named Miasma. The tradecraft used substantially matches Mini Shai-Hulud malware used by TeamPCP. Read now: https://t.co/ktpqy8loGB

[Unit 42 @Unit42_Intel]

An #adware campaign involving 50+ Chrome extensions (disguised as live wallpapers) has hit ~30K users. Spread across three publisher accounts, the attackers are pushing remote HTML to 40+ extensions and wiping IndexedDB on install and startup. Details at https://t.co/yihnkqJ3tj

[Unit 42 @Unit42_Intel]

We detected indirect prompt injection on a fake Excel template store. Hidden via white text, the prompt uses social engineering to manipulate AI agents into boosting SEO, aiming to funnel users to a malicious Chrome extension. Details at https://t.co/04V75Odz81

[Unit 42 @Unit42_Intel]

New analysis reveals a massive network of fraudulent domains capitalizing on the 2026 FIFA World Cup, with 1k+ registered in the past 6 months. Tactics include redirects to shady gambling apps, data harvesting, malvertising, and PUP downloads. Details at https://t.co/Lw0gpfN7SS

[Unit 42 @Unit42_Intel]

#TuxBot v3 Evolution: IoT malware/C2 framework tied to AISURU/Keksec. Self-ID "Akiru." 30-plus exploit targets, 1,496 credential pairs, encrypted C2, and DGA. Developers used an LLM to port exploits and write code, leaving traces in some files. Details at https://t.co/7mIjUcEG3y

[Unit 42 @Unit42_Intel]

2026-05-26 (Tuesday): Another page impersonating Claude was used to push #SHubStealer when viewed on a macOS host. Details at https://t.co/WcaIiQCdd6

[Unit 42 @Unit42_Intel]

Offensive and defensive framework ROADtools is being misused by nation-state actors for cloud attacks. Understand how to identify the activity that signals its malicious usage, including proactive hunting for anomalous activity: https://t.co/bq50zF1tFV

[CNN @CNN]

Iranian hackers have posed as job recruiters to target software engineers in the aviation sector as part of an elaborate espionage scheme during the US and Israeli war with Iran, cybersecurity researchers tell CNN. https://t.co/44rfkGFPHS

[Unit 42 @Unit42_Intel]

Users attempting to download open-source C++ IDE are hijacked via malicious CloudFront JS on-click, redirecting to fake MEGA-Transfer pages delivering #RemusStealer. Details at https://t.co/B9QBHn2xz0

[Unit 42 @Unit42_Intel]

A single threat actor uses multiple identities to run dozens of #AI-accelerated fake VPN Chrome extensions. All traffic routes through 15 SOCKS5 proxies, with some impersonating major VPN service providers. Details at https://t.co/HqhvzZSZaV

[Unit 42 @Unit42_Intel]

Iran-nexus APT Screening Serpens (aka UNC1549, Smoke Sandstorm) is deploying novel RAT variants in espionage campaigns targeting entities in the U.S., Israel and the UAE. These campaigns use AppDomainManager hijacking. Read our analysis for details: https://t.co/xTD398oRnx

[Unit 42 @Unit42_Intel]

We identified 4,000 samples of TamperedChef malware hiding in trojanized productivity apps. These campaigns use code signing to bypass security filters. The malware can remain dormant for days before stealing data. Read our analysis: https://t.co/IPCfRixbTh

[Unit 42 @Unit42_Intel]

2026-05-20 (Tuesday): Pages impersonating Claude and Homebrew continue to distribute malware like #MacSync stealer by employing a #ClickFix-style social engineering technique. Details at https://t.co/cTU26X3LhU

[Unit 42 @Unit42_Intel]

The latest Gremlin stealer variants employ multiple layers of obfuscation such as identifier renaming and string encryption. These methods remove context and hide intentions from static analysis tools. Read our analysis for technical insights: https://t.co/krEkZ8fND8

[Unit 42 @Unit42_Intel]

LinkedIn Search leads to #CastleLoader delivering #AsyncRAT. Attackers use Clickfix lures with fake verification popups to mask PowerShell activity. The loader decrypts the payload via RC4, using the first 64 bytes as a key to bypass filters. Details: https://t.co/0t5xZQFNgk

[Unit 42 @Unit42_Intel]

Active Directory Certificate Services is a high impact vector for privilege escalation. Adversaries misuse built-in features to impersonate accounts and establish persistence. Our research provides a deep dive into these methods. Read our analysis: https://t.co/24jLSrMp7j