Logo
Unit42 Logo
  • Tools
  • ATOMs
  • Security Consulting
  • About Us
  • Under Attack?
Pictorial representation of the npm packages supply chain attack. A blurred image focusing on a person typing on a laptop with lines of code visible on the screen, illuminated in blue and red lights, suggestive of intense coding or cyber activities.
 category iconHigh Profile Threats November 25, 2025

"Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 25)

Self-replicating worm “Shai-Hulud” has compromised hundreds of software packages in a supply chain attack targeting the npm ecosystem. We discuss scope and more.

  • Supply chain
  • JavaScript
  • Credential Harvesting
Read now
Pictorial representation of malicious LLMs. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.
 category iconThreat Research November 25, 2025

The Dual-Use Dilemma of AI: Malicious LLMs

  • Credential Harvesting
  • Data exfiltration
  • LLM
Read now
Pictorial representation of APT Howling Scorpius. The silhouette of a scorpion and the Scorpius constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.
 category iconInsights November 18, 2025

Anatomy of an Akira Ransomware Attack: When a Fake CAPTCHA Led to 42 Days of Compromise

  • Akira ransomware
  • Howling Scorpius
  • Unit 42
Read now
Pictorial representation of Gh0st RAT malware. A woman analyzes code on a computer screen in an office setting, with another individual working in the background.
 category iconThreat Research November 14, 2025

Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT

  • DLL Sideloading
  • Gh0st Rat
  • PDNS
Read now
Pictorial representation of an authentication coercion attack. Panoramic view of a city skyline at night, featuring vibrant light beams from skyscrapers and a deep blue sky.
 category iconThreat Research November 10, 2025

You Thought It Was Over? Authentication Coercion Keeps Evolving

  • Mimikatz
  • PrintNightmare
  • Privilege escalation
Read now
Pictorial representation of LANDFALL spyware. An illustration of a glowing red warning icon centered on a detailed blue circuit board background, representing a vulnerability in Samsung Galaxy devices.
 category iconThreat Research November 7, 2025

LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices

  • Android
  • Apple
  • CVE-2025-21042
Read now
Pictorial representation of a group of individuals conversing in an office setting.
 category iconInsights November 4, 2025

Know Ourselves Before Knowing Our Enemies: Threat Intelligence at the Expense of Asset Management

  • Network security
  • Threat intelligence
Read now
Pictorial representation of CVE-2025-59287. Digital image of a glowing padlock symbol representing cybersecurity on a network grid with blue and orange lights.
 category iconHigh Profile Threats November 3, 2025

Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild (Updated November 3)

  • CVE-2025-59287
  • Microsoft
  • Microsoft Vulnerability
Read now
A man wearing glasses focused on a screen with reflections of code visible in the glasses.
 category iconThreat Research October 31, 2025

When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems

  • GenAI
  • Google
  • LLM
Read now
Pictorial representation of Airstalk malware. A person typing on a laptop with digital graphics of binary code and light beams emanating from the screen, representing data transfer or cyber activity.
 category iconThreat Research October 29, 2025

Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack

  • .NET
  • CL-STA-1009
  • Malicious PowerShell scripts
Read now
Pictorial representation of a woman analyzing a display with code, graphs, and various other characters.
 category iconInsights October 28, 2025

Bots, Bread and the Battle for the Web

  • AI
  • SEO
  • SEO poisoning
Read now
Pictorial representation of cloud discovery with AzureHound. A digital representation of a cloud composed of blue light particles, superimposed over a blurred background of server racks in a data center.
 category iconThreat Research October 24, 2025

Cloud Discovery With AzureHound

  • Control plane
  • Curious Serpens
  • Data plane
Read now
Graphic representation of BOLA vulnerabilities. A smartphone displaying graphics of advanced digital technology and data analysis with vibrant red and blue lights, featuring a central icon labeled that looks like an envelope.
 category iconThreat Research October 23, 2025

The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

  • Phishing
  • Smishing
  • SMS
Read now
Loader icon View more
Newsletter
UNIT 42 Small Logo Get updates from Unit 42

Peace of mind comes from staying ahead of threats. Subscribe today.

Subscribe for email updates to all Unit 42 threat research.
By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.

Invalid captcha!

Get the latest news, invites to events, and threat alerts

By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.

Products and Services

  • AI-Powered Network Security Platform
  • Secure AI by Design
  • Prisma AIRS
  • AI Access Security
  • Cloud Delivered Security Services
  • Advanced Threat Prevention
  • Advanced URL Filtering
  • Advanced WildFire
  • Advanced DNS Security
  • Enterprise Data Loss Prevention
  • Enterprise IoT Security
  • Medical IoT Security
  • Industrial OT Security
  • SaaS Security
  • Next-Generation Firewalls
  • Hardware Firewalls
  • Software Firewalls
  • Strata Cloud Manager
  • SD-WAN for NGFW
  • PAN-OS
  • Panorama
  • Secure Access Service Edge
  • Prisma SASE
  • Application Acceleration
  • Autonomous Digital Experience Management
  • Enterprise DLP
  • Prisma Access
  • Prisma Browser
  • Prisma SD-WAN
  • Remote Browser Isolation
  • SaaS Security
  • AI-Driven Security Operations Platform
  • Cloud Security
  • Cortex Cloud
  • Application Security
  • Cloud Posture Security
  • Cloud Runtime Security
  • Prisma Cloud
  • AI-Driven SOC
  • Cortex XSIAM
  • Cortex XDR
  • Cortex XSOAR
  • Cortex Xpanse
  • Unit 42 Managed Detection & Response
  • Managed XSIAM
  • Threat Intel and Incident Response Services
  • Proactive Assessments
  • Incident Response
  • Transform Your Security Strategy
  • Discover Threat Intelligence

Company

  • About Us
  • Careers
  • Contact Us
  • Corporate Responsibility
  • Customers
  • Investor Relations
  • Location
  • Newsroom

Popular Links

  • Blog
  • Communities
  • Content Library
  • Cyberpedia
  • Event Center
  • Manage Email Preferences
  • Products A-Z
  • Product Certifications
  • Report a Vulnerability
  • Sitemap
  • Tech Docs
  • Unit 42
  • Do Not Sell or Share My Personal Information
PAN logo
  • Privacy
  • Trust Center
  • Terms of Use
  • Documents

Copyright © 2025 Palo Alto Networks. All Rights Reserved

  • Youtube
  • Podcast
  • Facebook
  • LinkedIn
  • Twitter
  • Select your language
    Your browser does not support the video tag.

    Default Heading

    Read the article Right Arrow