Palo Alto Networks' Unit 42 has responded to a growing number of AI token jacking cases, where cybercriminals steal API keys to access AI platforms, leading to staggering financial losses. The theft e…
Palo Alto Networks' vulnerability research team reported that its autonomous system, the Network and Open-Source Vulnerability Analyzer (NOVA), analyzed 3,915 open-source software projects in two mont…
Unit 42 identified a Chinese-speaking threat actor using the Hermes Agent framework with DeepSeek as an autonomous offensive operator to target infrastructure via seven vulnerabilities, combining AI-d…
Unit 42's 2026 Global Incident Response Report finds that AI is acting as a force multiplier for attackers, compressing attack lifecycles from days to hours, but the fundamental threat landscape remai…
Palo Alto Networks Unit 42 identified a previously undocumented modular IoT botnet framework named TuxBot v3 Evolution, whose authors used an LLM to assist in code development but left a safety discla…
Unit 42 researchers discovered that large language models consistently hallucinate web domains for legitimate brands, a phenomenon called phantom squatting. Adversaries are registering these nonexiste…
Palo Alto Networks' Unit 42 research has observed the first in-the-wild cases of web-based indirect prompt injection (IDPI) attacks, where adversaries embed hidden instructions in web content to manip…
Palo Alto Networks Unit 42 researchers discovered five malicious skills on OpenClaw's ClawHub marketplace between February and May 2026, including infostealers, evasion techniques, and novel agentic t…
Researchers at Palo Alto Networks Unit 42 discovered a vulnerability in Google Cloud Vertex AI SDK for Python that allowed attackers to hijack model uploads and achieve remote code execution across te…
Unit 42's 2026 Global Incident Response Report reveals attackers can move from initial access to data exfiltration in as little as 72 minutes, a 4X year-over-year acceleration. The speed gap forces SO…
Researchers introduced Behavioral Integrity Verification (BIV), an audit tool that compares AI agent skills' declared behavior against actual actions across metadata, code, and instructions. Testing o…
Threat actors are increasingly using Microsoft Teams to launch phishing attacks, with collaboration tool phishing alerts rising to 42% of all phishing alerts in early 2026. Groups like Cloaked Ursa an…
Palo Alto Networks Unit 42 researchers uncovered Operation FlutterBridge, a macOS malvertising campaign distributing a new backdoor called FlutterShell via Google Ads. The financially-motivated attack…
Unit 42 reports a significant decline in ransomware encryption use, dropping to 78% in 2025 as threat actors shift to data theft and extortion without encryption. Driven by advanced backups, endpoint …