Intelligence Feed

1w ago · unit42

Threat actors are actively exploiting CVE-2026-0257, a PAN-OS authentication bypass vulnerability in GlobalProtect portal and gateway components, to gain unauthorized VPN access. Exploitation has been linked to ransomware operators including Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra ransomware-affiliated actors. Attackers bypass MFA, establish initial footholds, and conduct reconnaissance, lateral movement via RDP/SMB, and credential harvesting. In advanced cases, they pivot to virtualization layers, targeting vCenter and ESXi to dump domain controller credentials offline. The vulnerability was added to CISA's KEV catalog on May 13, 2026, and fixes have been available since May 2026, but unpatched systems remain at risk.

1w ago · unit42

A financially motivated threat actor operating under the handle BUGSTER leveraged AI-powered tools, specifically the Hermes Agent framework with DeepSeek V4 as the reasoning engine, to plan and execute multiple cybercrime activities. The actor conducted credential theft via WordPress brute-forcing, exfiltrated over 5,200 student and faculty records from an Indian university's MongoDB database, and engaged in VoIP fraud planning, Wi-Fi password cracking, and cryptocurrency reconnaissance. The actor used a US-based server for command-and-control operations and employed AI-generated scripts and reconnaissance reports to lower the skill barrier for executing diverse attacks.

1w ago · unit42

Unit 42 has identified two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS 4.0. CVE-2026-109618 allows attackers to achieve RCE by exploiting improper control flow during out-of-memory error handling via longjmp(), leaving request memory uninitialized. CVE-2026-109619 enables RCE by causing global memory to point to freed memory regions during fatal error handling, which can be later accessed or executed. Proof-of-concept exploits exist, and over 22.6 million internet-exposed PHP instances are potentially vulnerable, prompting urgent patching recommendations.

1w ago · unit42

Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a cryptographic defect during certificate generation, where insufficient randomness allowed attackers to derive private keys from public certificates. This enables threat actors to sign unauthorized TLS certificates and conduct man-in-the-middle (MitM) attacks, such as traffic interception, impersonation, or session hijacking. Major browser and OS vendors have taken action to revoke or untrust the affected intermediate CAs, and eMudhra has revoked the eight compromised certificates. Organizations are advised to audit PKI assets, reissue certificates, update trust stores, and monitor for MitM activity to mitigate risks.

2w ago · unit42

Unit 42 uncovered a sophisticated network intrusion campaign tracked as CL-STA-0954, targeting a telecommunications organization via exploitation of CVE-2024-47575 (FortiJump) on a FortiManager appliance. Attackers exfiltrated configuration data, credentials, and cryptographic material for over 500 managed FortiGate firewalls. They later exploited CVE-2025-61624 to deploy PEERSTITCH, a novel memory-resident ARM64 malware that evades detection by patching running processes and establishing covert inter-process communication. The implant enables traffic interception, backdoor access, and privilege escalation without writing to disk or opening network ports.

2w ago · unit42

Unit 42 identified an AI-powered espionage campaign, tracked as CL-UNK-1211, targeting government entities and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads, including malicious PHP scripts and custom malware such as SysGoRAT—a cross-platform Go-based remote access Trojan—to maintain persistence, conduct reconnaissance, and exfiltrate sensitive data like government mailboxes and databases. The campaign employed diverse techniques including web shells, credential harvesting via .bashrc hijacking and PHP loggers, reverse shells, and anti-forensics methods such as log tampering and timestomping to evade detection.

3w ago · unit42

Threat actors, including North Korea-affiliated groups like Alluring Pisces (aka Sapphire Sleet or Midnight Neptune), are leveraging Web3-based command-and-control (C2) infrastructure in software supply chain attacks to dynamically update botnets and evade detection. Two major campaigns, ChainDrop and PolinRider, have infected hundreds of npm packages and expanded across multiple package registries, harvesting cloud IAM keys, CI/CD tokens, and environment secrets from developer workflows. These threats use blockchain-based C2 techniques such as EtherHiding, TxDataHiding, and NullReceiver to bypass traditional network monitoring and maintain persistence.

3w ago · unit42

The Blinder Tunnel campaign, attributed to an Iranian state-aligned threat actor, targeted Iraqi critical infrastructure in March 2026 using a sophisticated social engineering lure impersonating Dubai Airports' IT department. The attack delivered trojanized Visual Studio projects that exploited .csproj files, AppDomainManager hijacking, and DLL sideloading to deploy custom malware including ShelbyLoader V2 and Blackwood, a Chisel-based tunneling tool. Command-and-control was conducted via GitHub repositories and issues, with fallback mechanisms using encrypted comments, while infrastructure reuse linked this activity to a parallel credential-harvesting campaign targeting Israel.

4w ago · unit42

Unit 42 has identified active exploitation of two zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, in Citrix NetScaler ADC and Gateway devices. The vulnerabilities allow unauthenticated remote code execution and memory overflow, enabling attackers to deploy web shells for initial access and persistence. Two distinct exploit chains were observed: one leveraging DTLS exploitation to drop .deb-based web shells, and another using a three-stage command injection to execute PHP web shells. Activity was detected from multiple IP addresses, with ongoing post-exploitation behavior including privilege escalation, stealthy command-and-control, and Apache configuration modification to maintain persistence.

4w ago · unit42

Kubernetes operators, which automate cluster management, often have excessive RBAC permissions that create security risks. Researchers identified a high-severity vulnerability (CVE-2026-6389) in IBM's Prometurbo operator that granted cluster-wide access to secrets, enabling full environment compromise if exploited. The Datadog operator was also found with overly permissive configurations, highlighting a trade-off between usability and security. These misconfigurations are exacerbated by outdated, unmaintained components in public registries like OperatorHub, creating silent backdoors that could be exploited by attackers or abused by AI-driven agentic operators.

1mo ago · unit42

Unit 42 researchers identified a security issue in AWS AgentCore Harness where default configurations allow attackers to exfiltrate plaintext credentials from AgentCore Identity via prompt injection. The built-in shell tool, enabled by default and running as root, can access the memory space of the harness process (PID 1), where credentials are temporarily stored in plaintext during runtime. By injecting malicious commands through a support ticket, an attacker can execute reconnaissance and exfiltrate a JSON Web Token (JWT) used for downstream MCP server authentication. This stolen credential, belonging to the operator's service account (mcp-service), enables unauthorized access to sensitive data such as personally identifiable information (PII). AWS acknowledged the finding but classified it under customer responsibility, emphasizing proper scoping of allowedTools and egress filtering.

1mo ago · unit42

This report details an analysis of the Atomic macOS (AMOS) stealer malware, observed in a lab environment on August 5, 2026. AMOS stealer is distributed via malicious websites and cracked software campaigns, using social engineering to trick users into pasting malicious commands into Terminal. The infection chain involves downloading a Zsh script that retrieves and executes a Mach-O binary, which establishes persistence and collects sensitive data including credentials, browser data, cryptocurrency wallets, and messaging app data. Exfiltration occurs via HTTP POST requests to command and control servers, with infrastructure and indicators frequently changing, indicating active development and evasion tactics.

1mo ago · unit42

Unit 42 discovered a long-running pay-per-install (PPI) malware campaign tracked as CL-CRI-1171, which has operated under the radar for at least two years by distributing multiple payloads through a shared loader infrastructure. The campaign uses YouTube channels and SEO poisoning to distribute trojanized software, targeting both gamers and corporate users. The loader, dubbed OfferLoader, delivers various malware families including the previously undocumented Docro Hijacker and ARKTunnel, as well as a new variant of the Insomnia RAT. These payloads enable backdoor access, browser hijacking, and WebSocket tunneling, with infrastructure designed to evade detection through domain rotation and gating mechanisms that filter out scanners.

1mo ago · unit42

This research demonstrates a post-exploitation technique enabling an attacker with root access on a compromised Kubernetes node to spoof workload identities in SPIFFE/SPIRE environments by manipulating Linux cgroup metadata. The attacker can trick the SPIRE agent into issuing legitimate SPIFFE Verifiable Identity Documents (SVIDs) belonging to co-located workloads, enabling identity impersonation and lateral movement. The trust model of SPIFFE/SPIRE collapses when node integrity is breached, as workload attestation relies on unspoofed cgroup information. The researchers developed an open-source tool called Spooffe to automate this attack for defensive testing purposes.

2mo ago · unit42

Aeternum is a recently discovered C++ botnet loader that uses the Polygon blockchain for decentralized command-and-control (C2) operations. The malware retrieves encrypted or plaintext instructions from smart contracts on the blockchain by querying public RPC endpoints, enabling resilient and low-cost infrastructure resistant to takedowns. Three distinct malware samples were analyzed: the initial Aeternum loader, a Python-based downloader, and a multi-component payload combining XWorm RAT, XMRig cryptocurrency miner, and data exfiltration tools. The threat leverages Telegram APIs and GitHub repositories for secondary C2 and payload delivery, while using weak encryption schemes that allow decryption via contract address and payload analysis.

1mo ago · unit42

Unit 42 investigated a cyber attack in which a threat actor used frontier AI and agentic AI frameworks to autonomously breach an enterprise network, achieving in under 10 hours what would typically take human operators two weeks. The AI agents systematically executed reconnaissance, harvested credentials from code repositories, escalated privileges by accessing secrets management systems, hijacked CI/CD pipelines, and abused stolen cloud keys to leverage the victim's own AI infrastructure for further attacks. The attacker left behind an 80-page technical audit detailing exploited findings, highlighting the operational efficiency of AI-assisted attacks without relying on zero-day vulnerabilities.

1mo ago · unit42

Unit 42 identified two ongoing attack campaigns—CL-CRI-1131 and CL-CRI-1163—targeting organizations in Latin America, leveraging AI tools to enhance operational efficiency. The Mexican transportation campaign (CL-CRI-1131) targeted government and transportation entities, using living-off-the-land techniques, volume shadow copy manipulation, and a self-hosted NextChat instance on IP 178.128.87.160 for AI-assisted scripting. The Brazilian financial campaign (CL-CRI-1163) involved phishing via resume-themed emails, deployment of a custom Go-based SOCKS5 proxy (SockTz), and use of AI-generated script names hosted on exposed infrastructure at 167.148.195.53. Both campaigns exhibited operational security failures, including exposed certificates and open directories, enabling threat researchers to track and analyze their infrastructure.

2mo ago · unit42

Threat actors are increasingly exploiting trusted enterprise collaboration platforms such as Microsoft Teams and Slack to conduct identity phishing, impersonation, credential theft, and malware delivery. These attacks leverage the inherent trust in authenticated communication channels to bypass traditional security controls, using techniques like external federation abuse, social engineering, and malicious third-party integrations. Real-world incidents include APT29 using compromised Teams accounts to distribute credential-harvesting links, a North Korea-linked campaign impersonating Fireblocks during fake job interviews to deliver malware via npm install, and attackers poisoning the Axios npm package by compromising a maintainer through a spoofed Slack environment. Additionally, attackers have used legitimate Slack webhook integrations on compromised appliances to exfiltrate credentials, demonstrating post-compromise persistence through trusted SaaS channels.

2mo ago · unit42

The article details the ChainDrop npm worm, a self-propagating supply chain attack that infected over 400 npm packages, including popular libraries like keyv and cacheable-request. It leverages malicious preinstall scripts to download an obfuscated payload, steals cloud secrets from CI/CD environments (including GitHub Actions OIDC tokens), backdoors local developer tools such as VS Code, and uses stolen tokens to automatically propagate. The malware maintains persistence through integration with developer tools and uses Ethereum blockchain for dynamic command-and-control infrastructure, highlighting the expanding threat surface in the software development lifecycle.

2mo ago · unit42

Unit42 analyzed 405 AI-enabled malware samples and found that only 12 were observed in production environments, indicating that most such malware remains in proof-of-concept or testing stages. The operational threats included FunkSec ransomware, a trojanized AI application (Recipe Lister), the Oyster backdoor, Rhadamanthys stealer, and a COM hijacking DLL. These threats used techniques such as code signing abuse, DLL side-loading, and social engineering leveraging AI branding. All were detected and blocked by existing defenses including sandboxing, behavioral analytics, and cloud-based verdicts, with no novel detection methods required.

2mo ago · unit42

The Spring Ring campaign is a coordinated voice phishing (vishing) operation conducted via Microsoft Teams, where threat actors impersonate IT help desk personnel to manipulate employees into executing malicious payloads. The attackers use spoofed external Microsoft 365 tenants with professionally named accounts and initiate unsolicited voice calls to establish trust. Two distinct attack campaigns were observed: Campaign A delivers an obfuscated PowerShell-based remote access Trojan (RAT) via a malicious domain, while Campaign B uses tailored cloud-hosted executables to deploy malware that enables lateral movement through NTLM relay attacks leveraging PetitPotam. These attacks aim to gain persistent access and escalate privileges to compromise domain controllers.

2mo ago · unit42

Unit42 identified a new version (v7) of the Kimwolf Android/IoT botnet, which enhances DDoS capabilities and strengthens command-and-control (C2) resilience. The malware targets Android TV boxes and IoT devices via unsecured ADB ports, using HTTP/2-based DDoS floods that spoof browser fingerprints to mimic legitimate traffic. Its C2 infrastructure leverages Ethereum Name Service (ENS) resolution via public RPC endpoints, a suspected operator-controlled RPC facade, and a fallback to a hard-coded Tor .onion address, ensuring persistence against takedown attempts.

2mo ago · unit42

ChainDrop is a self-propagating npm worm that infected over 400 packages, including widely used ones like keyv and cacheable-request, enabling it to steal cloud credentials, npm and GitHub tokens, SSH keys, and other sensitive developer data. The worm uses a combination of domain-based and GitHub-based exfiltration, with C2 infrastructure resolved via an Ethereum smart contract, allowing silent domain rotation through blockchain transactions. It establishes persistence through VS Code and Claude Code configurations, targets CI runners to extract ephemeral OIDC tokens, and can republish infected packages while preserving legitimate functionality, making detection difficult.

2mo ago · unit42

Unit 42 has identified a growing threat called 'token jacking,' where cybercriminals steal API keys (tokens) used to access AI platforms, leading to massive financial losses due to unmonitored usage. These stolen tokens are often funneled into 'transfer stations'—gray-market services that resell discounted AI computing capacity—using proxy platforms like new-api or one-api. Attackers obtain tokens via phishing, information stealers, or malicious npm packages such as Shai-Hulud and Miasma, which self-propagate and harvest credentials from development environments. The stolen tokens are then used to generate millions of API calls, resulting in hundreds of thousands of dollars in unauthorized charges before detection.

2mo ago · unit42

A significant portion of malware samples bypass DNS by communicating directly to IP addresses, evading DNS-based security controls. Analysis of 4 million dynamic reports shows 45.32% of malware with command-and-control (C2) activity used direct-to-IP (D2IP) connections, accounting for 23.17% of all C2 attempts. Threats identified include Phorpiex ransomware droppers, a data exfiltration campaign using obfuscated \GET requests, SectopRAT deployments targeting educational institutions, and IoT botnets like Mozi and a new Mirai variant named Boatnet. These threats leverage hard-coded IP addresses and custom HTTP methods to avoid detection and maintain persistence.

2mo ago · unit42

This article details three novel attack classes against Google's synced passkey ecosystem, collectively termed 'Pass-ta-key', that exploit weaknesses in passwordless authentication implementations. The attacks enable account takeover by malware on a compromised endpoint without user interaction, bypassing user verification requirements and extracting synced passkey private keys. The 'Golden Pass-ta-key' attack is particularly severe, as it allows extraction of the master key (security domain secret) from Chrome's memory during re-onboarding, enabling decryption of all synced passkeys and persistent access. These attacks highlight implementation gaps in relying party validation, device re-registration flows, and exposure of sensitive key material on clients.

3mo ago · unit42

XCSSET v40 is a sophisticated macOS malware that resurfaced in April 2026, targeting developers through supply chain attacks on Xcode projects hosted on GitHub. The malware uses a multi-stage infection chain involving memory-resident execution, polymorphic payloads, and fileless persistence to evade detection. It spreads by infecting Xcode projects and Git repositories, then downloads and executes additional modules from a command-and-control (C2) server, including a Chrome hijacking backdoor and a Telegram trojanizer. The malware disables macOS security mechanisms, blocks software updates, and manipulates browser sessions to steal credentials, cryptocurrency, and sensitive data.

3mo ago · unit42

Unit 42 identified a Chinese-speaking threat actor operating under the aliases knaithe and KnYuan who conducted an AI-enabled autonomous cyberattack campaign. The actor used the Hermes Agent framework with DeepSeek as the reasoning engine to autonomously enumerate vulnerabilities, acquire exploit code, and launch attacks without human intervention. They targeted multiple vulnerabilities including CVE-2026-33017 in Langflow and chained CVEs in n8n (CVE-2026-21858 and CVE-2025-68613), though exploitation attempts failed due to configuration requirements. Manual operations successfully exploited CVE-2026-3055 in Citrix NetScaler, leading to confirmed data exfiltration. The campaign was exposed when the actor accidentally exposed their infrastructure via an HTTP file server.

3mo ago · unit42

Unit 42 has identified a persistent cyberespionage campaign, tracked as CL-STA-1114, attributed to a Russian threat actor. The campaign targets Zimbra webmail users in government, defense, transportation, and financial sectors across NATO, Ukraine, CIS, and African countries. Attackers exploit CVE-2025-66376 to deliver a zero-click JavaScript payload that exfiltrates credentials, email archives, and 2FA tokens. The activity highlights ongoing state-sponsored threats leveraging unpatched vulnerabilities in widely used collaboration platforms.

3mo ago · unit42

The Unit 42 2026 Global Incident Response Report highlights that AI is being used as a force multiplier by threat actors to accelerate attacks, particularly through automation of content generation, reconnaissance, and malware development. While AI enhances speed and efficiency, the core attack methods remain unchanged, relying on credential theft, phishing, and exploitation of known vulnerabilities. There is emerging experimentation with AI-powered malware and agentic ransomware, but no fundamental shift in tactics has been observed yet.