Intelligence Feed

1w ago · unit42

Threat actors are increasingly exploiting trusted enterprise collaboration platforms such as Microsoft Teams and Slack to conduct identity phishing, impersonation, credential theft, and malware delivery. These attacks leverage the inherent trust in authenticated communication channels to bypass traditional security controls, using techniques like external federation abuse, social engineering, and malicious third-party integrations. Real-world incidents include APT29 using compromised Teams accounts to distribute credential-harvesting links, a North Korea-linked campaign impersonating Fireblocks during fake job interviews to deliver malware via npm install, and attackers poisoning the Axios npm package by compromising a maintainer through a spoofed Slack environment. Additionally, attackers have used legitimate Slack webhook integrations on compromised appliances to exfiltrate credentials, demonstrating post-compromise persistence through trusted SaaS channels.

1w ago · unit42

The article details the ChainDrop npm worm, a self-propagating supply chain attack that infected over 400 npm packages, including popular libraries like keyv and cacheable-request. It leverages malicious preinstall scripts to download an obfuscated payload, steals cloud secrets from CI/CD environments (including GitHub Actions OIDC tokens), backdoors local developer tools such as VS Code, and uses stolen tokens to automatically propagate. The malware maintains persistence through integration with developer tools and uses Ethereum blockchain for dynamic command-and-control infrastructure, highlighting the expanding threat surface in the software development lifecycle.

1w ago · unit42

Unit42 analyzed 405 AI-enabled malware samples and found that only 12 were observed in production environments, indicating that most such malware remains in proof-of-concept or testing stages. The operational threats included FunkSec ransomware, a trojanized AI application (Recipe Lister), the Oyster backdoor, Rhadamanthys stealer, and a COM hijacking DLL. These threats used techniques such as code signing abuse, DLL side-loading, and social engineering leveraging AI branding. All were detected and blocked by existing defenses including sandboxing, behavioral analytics, and cloud-based verdicts, with no novel detection methods required.

2d ago · unit42

The Spring Ring campaign is a coordinated voice phishing (vishing) operation conducted via Microsoft Teams, where threat actors impersonate IT help desk personnel to manipulate employees into executing malicious payloads. The attackers use spoofed external Microsoft 365 tenants with professionally named accounts and initiate unsolicited voice calls to establish trust. Two distinct attack campaigns were observed: Campaign A delivers an obfuscated PowerShell-based remote access Trojan (RAT) via a malicious domain, while Campaign B uses tailored cloud-hosted executables to deploy malware that enables lateral movement through NTLM relay attacks leveraging PetitPotam. These attacks aim to gain persistent access and escalate privileges to compromise domain controllers.

3w ago · unit42

Unit42 identified a new version (v7) of the Kimwolf Android/IoT botnet, which enhances DDoS capabilities and strengthens command-and-control (C2) resilience. The malware targets Android TV boxes and IoT devices via unsecured ADB ports, using HTTP/2-based DDoS floods that spoof browser fingerprints to mimic legitimate traffic. Its C2 infrastructure leverages Ethereum Name Service (ENS) resolution via public RPC endpoints, a suspected operator-controlled RPC facade, and a fallback to a hard-coded Tor .onion address, ensuring persistence against takedown attempts.

3w ago · unit42

ChainDrop is a self-propagating npm worm that infected over 400 packages, including widely used ones like keyv and cacheable-request, enabling it to steal cloud credentials, npm and GitHub tokens, SSH keys, and other sensitive developer data. The worm uses a combination of domain-based and GitHub-based exfiltration, with C2 infrastructure resolved via an Ethereum smart contract, allowing silent domain rotation through blockchain transactions. It establishes persistence through VS Code and Claude Code configurations, targets CI runners to extract ephemeral OIDC tokens, and can republish infected packages while preserving legitimate functionality, making detection difficult.

3w ago · unit42

Unit 42 has identified a growing threat called 'token jacking,' where cybercriminals steal API keys (tokens) used to access AI platforms, leading to massive financial losses due to unmonitored usage. These stolen tokens are often funneled into 'transfer stations'—gray-market services that resell discounted AI computing capacity—using proxy platforms like new-api or one-api. Attackers obtain tokens via phishing, information stealers, or malicious npm packages such as Shai-Hulud and Miasma, which self-propagate and harvest credentials from development environments. The stolen tokens are then used to generate millions of API calls, resulting in hundreds of thousands of dollars in unauthorized charges before detection.

4w ago · unit42

A significant portion of malware samples bypass DNS by communicating directly to IP addresses, evading DNS-based security controls. Analysis of 4 million dynamic reports shows 45.32% of malware with command-and-control (C2) activity used direct-to-IP (D2IP) connections, accounting for 23.17% of all C2 attempts. Threats identified include Phorpiex ransomware droppers, a data exfiltration campaign using obfuscated \GET requests, SectopRAT deployments targeting educational institutions, and IoT botnets like Mozi and a new Mirai variant named Boatnet. These threats leverage hard-coded IP addresses and custom HTTP methods to avoid detection and maintain persistence.

4w ago · unit42

This article details three novel attack classes against Google's synced passkey ecosystem, collectively termed 'Pass-ta-key', that exploit weaknesses in passwordless authentication implementations. The attacks enable account takeover by malware on a compromised endpoint without user interaction, bypassing user verification requirements and extracting synced passkey private keys. The 'Golden Pass-ta-key' attack is particularly severe, as it allows extraction of the master key (security domain secret) from Chrome's memory during re-onboarding, enabling decryption of all synced passkeys and persistent access. These attacks highlight implementation gaps in relying party validation, device re-registration flows, and exposure of sensitive key material on clients.

4w ago · unit42

XCSSET v40 is a sophisticated macOS malware that resurfaced in April 2026, targeting developers through supply chain attacks on Xcode projects hosted on GitHub. The malware uses a multi-stage infection chain involving memory-resident execution, polymorphic payloads, and fileless persistence to evade detection. It spreads by infecting Xcode projects and Git repositories, then downloads and executes additional modules from a command-and-control (C2) server, including a Chrome hijacking backdoor and a Telegram trojanizer. The malware disables macOS security mechanisms, blocks software updates, and manipulates browser sessions to steal credentials, cryptocurrency, and sensitive data.

4w ago · unit42

Unit 42 identified a Chinese-speaking threat actor operating under the aliases knaithe and KnYuan who conducted an AI-enabled autonomous cyberattack campaign. The actor used the Hermes Agent framework with DeepSeek as the reasoning engine to autonomously enumerate vulnerabilities, acquire exploit code, and launch attacks without human intervention. They targeted multiple vulnerabilities including CVE-2026-33017 in Langflow and chained CVEs in n8n (CVE-2026-21858 and CVE-2025-68613), though exploitation attempts failed due to configuration requirements. Manual operations successfully exploited CVE-2026-3055 in Citrix NetScaler, leading to confirmed data exfiltration. The campaign was exposed when the actor accidentally exposed their infrastructure via an HTTP file server.

1mo ago · unit42

Unit 42 has identified a persistent cyberespionage campaign, tracked as CL-STA-1114, attributed to a Russian threat actor. The campaign targets Zimbra webmail users in government, defense, transportation, and financial sectors across NATO, Ukraine, CIS, and African countries. Attackers exploit CVE-2025-66376 to deliver a zero-click JavaScript payload that exfiltrates credentials, email archives, and 2FA tokens. The activity highlights ongoing state-sponsored threats leveraging unpatched vulnerabilities in widely used collaboration platforms.

1mo ago · unit42

The Unit 42 2026 Global Incident Response Report highlights that AI is being used as a force multiplier by threat actors to accelerate attacks, particularly through automation of content generation, reconnaissance, and malware development. While AI enhances speed and efficiency, the core attack methods remain unchanged, relying on credential theft, phishing, and exploitation of known vulnerabilities. There is emerging experimentation with AI-powered malware and agentic ransomware, but no fundamental shift in tactics has been observed yet.

1mo ago · unit42

Palo Alto Networks and Siemens collaborated to identify a chained exploit involving three zero-day vulnerabilities (CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949) in Siemens ROX II OT switches. The attack chain begins with arbitrary file disclosure, enables privilege escalation via command injection, and establishes persistent root-level access through the task scheduler. These vulnerabilities allow an unauthenticated attacker to gain full control of critical OT switches, potentially disrupting industrial operations. Siemens has released firmware updates, and virtual patching is available via Palo Alto Networks.

1mo ago · unit42

The Unit 42 2026 Global Incident Response Report highlights how AI is acting as a force multiplier for cyber attackers, accelerating existing attack methods rather than introducing new ones. Threat actors are leveraging AI to streamline malware development, automate phishing content, and enhance reconnaissance, reducing attack timelines significantly. Despite these efficiency gains, core tactics such as credential theft, phishing, and exploitation of known vulnerabilities remain unchanged. Defenders are advised to strengthen prevention controls and combine AI proficiency with human judgment to counter AI-enhanced threats.

1mo ago · unit42

The npm ecosystem has faced escalating supply chain attacks since the emergence of the Shai-Hulud worm in September 2025. These attacks have evolved into sophisticated, wormable campaigns that steal credentials, propagate across packages, and establish persistent access in CI/CD pipelines. Recent operations, including Mini Shai-Hulud and Miasma variants, have targeted major organizations like Red Hat and AsyncAPI, using novel initial access techniques and resilient C2 infrastructure. The public release of Mini Shai-Hulud tooling has increased the risk of copycat campaigns.

1mo ago · unit42

TuxBot v3 Evolution is a modular IoT botnet framework leveraging LLM-assisted development, capable of DDoS attacks, device infection via Telnet brute-forcing, and persistence across multiple architectures. The malware uses encrypted C2 communication with fallback mechanisms including DGA, P2P gossip, and IRC, though several components are non-functional due to development bugs. The operator is linked to the Keksec/Kaitori ecosystem, sharing infrastructure with known IoT threats, and has active C2 servers in Singapore and a dropper in Iceland.

1mo ago · unit42

The Gentlemen, also known as Storm-2697, is a Ransomware-as-a-Service (RaaS) operation active since July 2025, believed to have evolved from the Qilin RaaS affiliate ArmCorp. They offer affiliates an unusually high 90% ransom payout, contributing to rapid growth, with over 580 victims claimed across 77 countries by mid-2026. The group uses diverse initial access methods, custom tools like the 'GentleKiller' EDR killer, and exploits vulnerabilities in edge devices and protocols to target enterprises, particularly in manufacturing.

1mo ago · unit42

In April 2026, a financially motivated campaign distributed the Vidar stealer and XMRig cryptocurrency miner via malvertising, targeting users searching for cracked software. The attackers used password-protected archives with fake code signing certificates to evade detection and deliver payloads. The malware employed file inflation, DLL sideloading, and AMSI bypass techniques to avoid sandbox analysis and security controls. Victims were primarily located in the U.S. and EU, with data exfiltrated to C2 servers and Monero mining initiated through a configured pool.

2mo ago · unit42

AI agents are increasingly extended with third-party skills from public registries, creating supply chain risks due to insufficient behavioral verification. A new audit method called Behavioral Integrity Verification (BIV) reveals that 80% of skills exhibit behavioral deviations from their declared capabilities, with 18.9% showing adversarial intent. These malicious skills often form multi-stage attack chains enabling credential exfiltration, remote code execution, or silent data theft, highlighting the need for pre-installation integrity checks in AI agent ecosystems.

2mo ago · unit42

A new forensic artifact, App.MenuItem, has been discovered in macOS Tahoe 26, which logs user menu interactions such as 'Compress' and 'Move to Trash' to provide insight into user intent. This artifact is stored in a SEGB-encapsulated protobuf format within the Apple Biome system and requires specialized tools like ccl-segb for parsing. The data enables investigators to reconstruct user workflows, such as data compression and deletion, enhancing visibility into potential data exfiltration or malicious activity.

2mo ago · unit42

The article highlights the increasing speed of cyberattacks, with adversaries achieving data exfiltration in as little as 72 minutes. Attackers leverage compromised credentials and identity-based techniques to rapidly escalate privileges and move laterally across environments. Modern SOCs struggle to keep pace due to manual processes and fragmented workflows. Threat actors like Muddled Libra and Spoiled Scorpius are exemplifying this trend by exploiting identity weaknesses to accelerate attack timelines.

2mo ago · unit42

A vulnerability in the Google Cloud Vertex AI Python SDK versions 1.139.0 and 1.140.0 allowed attackers to hijack model uploads via bucket squatting, leading to cross-tenant remote code execution (RCE). By predicting and preemptively creating a default staging bucket, an attacker could intercept and replace legitimate model artifacts with malicious payloads exploiting pickle deserialization. The victim's model deployment would then execute the attacker's code, enabling credential theft and lateral movement within Google Cloud environments.

2mo ago · unit42

A universal bucket hijacking technique has been identified that exploits the global uniqueness of cloud storage bucket names across major cloud providers including Google Cloud, AWS, and Microsoft Azure. Attackers with permissions to delete a storage bucket can recreate it under their control, redirecting data streams such as logs, Pub/Sub messages, and storage transfers to their own environment, leading to silent data exfiltration. While no active exploitation has been observed, the architectural flaw enables long-term, undetectable compromise of sensitive data if proper IAM controls and monitoring are not in place.

2mo ago · unit42

OpenClaw's skill marketplace, ClawHub, has become a vector for AI supply chain attacks involving malicious skills that distribute infostealers, evade detection through file padding, and enable financial fraud via affiliate injection and front-running schemes. Multiple malicious skills were discovered between February and May 2026, leveraging paste-site redirects, C2 infrastructure, and dynamic payload delivery. These threats bypassed automated screening tools like VirusTotal and ClawScan, highlighting weaknesses in current detection mechanisms. Palo Alto Networks has collaborated with ClawHub and NVIDIA to improve skill verification and protect customers through advanced security services.

2mo ago · unit42

CL-STA-1062, a Chinese-speaking threat actor group active since at least March 2022, has been targeting government entities and critical infrastructure in Southeast Asia. The group, also tracked as UAT-7237, uses a hybrid toolkit combining open-source tools like SoftEther VPN, Mimikatz, and VNT with a custom backdoor named TinyRCT. This backdoor enables command execution, file exfiltration, screen capture, and self-destruction, and is deployed via AppDomainManager injection through a maliciously crafted archive. The campaign demonstrates a sustained regional focus, with attacks spanning from Taiwan to Southeast Asia, particularly targeting energy and government sectors.

2mo ago · unit42

Unit 42 has identified a large-scale password spraying and credential theft campaign dubbed 'FortiBleed' targeting Fortinet, Sophos, and MSSQL services. The threat actors use a curated password list derived from prior breaches and previously compromised credentials to conduct password spraying attacks, extract device configurations, and perform offline password cracking. An initial access broker has claimed responsibility on the Exploit[.]in forum, offering stolen credentials for sale. Palo Alto Networks recommends hardening remote access controls, enabling MFA, and monitoring for suspicious login patterns.

2mo ago · unit42

Unit 42 researchers identified a new threat called 'phantom squatting,' where adversaries register AI-hallucinated domains to exploit software supply chains. Large language models (LLMs) frequently generate fictitious domains for legitimate brands, and attackers preemptively register these domains to intercept traffic from AI systems and users. A real-world case involved the 'Montana Empire' phishing kit, which targeted a hallucinated domain 23 days before its registration, demonstrating AI-assisted attack development. The research uncovered 13,229 malicious URLs and approximately 250,000 unregistered hallucinated domains, highlighting a growing risk to AI-driven workflows and developer tooling.

2mo ago · unit42

This article details a research effort to implement WebAuthn redirection in a browser-based RDP client, reverse-engineering Microsoft's undocumented internal handling of WebAuthn in Windows. The research uncovered that Microsoft's mstsc.exe uses an undocumented internal plugin path in webauthn.dll to process hash-only WebAuthn requests from older Windows servers, while public APIs require full clientDataJSON. The work enabled the first non-Windows implementation of WebAuthn redirection in an RDP client, predating FreeRDP's support. The findings highlight critical gaps in Microsoft's documentation and the complexity of cross-platform WebAuthn implementation in RDP environments.