BleepingComputer

Fake Palo Alto GlobalProtect used as lure to backdoor enterprises

Threat actors target Middle Eastern organizations with malware disguised as the legitimate Palo Alto GlobalProtect Tool that can steal data and execute remote PowerShell commands to infiltrate ...
BleepingComputer

New wave of VPN login attempts targets Palo Alto GlobalProtect portals

A campaign has been observed targeting Palo Alto GlobalProtect portals with login attempts and launching scanning activity against SonicWall SonicOS API endpoints. The activity started on December 2nd ...
Hosted on MSN

Palo Alto Networks just confirmed active exploitation of an authentication bypass in its GlobalProtect VPN — unpatched boxes now getting hit across the internet

Federal agencies have until June 1, 2026, to patch a critical authentication bypass in Palo Alto Networks’ GlobalProtect VPN, and the clock started ticking on May 29. That is a three-day remediation ...
Help Net Security

Attackers are probing Palo Alto Networks GlobalProtect portals

Cybersecurity company GreyNoise is warning about a significant increase of scanning activity targeting internet-facing Palo Alto Networks GlobalProtect portals in the last 30 days, and has urged ...