Palo Alto Unit 42

Mentions · 7d0
Mentions · 30d0
All mentions2
First seenSep 16, 2026
Last mentionedOct 6, 2026

Timeline

2 articles · newest first

Blinder Tunnel Campaign Targets Iraqi Infrastructure

Unit 42 attributes the Blinder Tunnel campaign to Iranian state-aligned CL-STA-1178, which impersonated Dubai Airports IT to hit Iraqi critical infrastructure.

Palo Alto Unit 42updated Oct 6, 14:31 UTC · Oct 6, 2026first Oct 6, 10:00 UTC · Oct 6, 2026Threat actorExploited3 sources11 · 3 reads

Atomic macOS (AMOS) Stealer Activity

Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.

Palo Alto Unit 42Sep 16, 10:00 UTC · Sep 16, 2026MalwareExploited4 · 1 read

Appears with

Telegramproduct · 1
GitHuborganization · 1
Chiselorganization · 1
Binanceproduct · 1
TonKeeperproduct · 1
AMOS Stealermalware · 1
Dubai Airportsorganization · 1
FileZillaproduct · 1
Palo Alto Unit 42vendor · 1
ShelbyLoader V2organization · 1
CL-STA-1178organization · 1

Entities are extracted by the model from each article. First seen Sep 16, 2026, last mentioned Oct 6, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.