A suspected initial access broker behind FortiGate GlobalProtect attacks exposed 70,000+ credentials. See how k0t operates and how to defend.

Related Posts:

• Doppelganger Campaign Targets Israel Elections With Fake News and AI Poisoning
• Storm-0940 Uses ARTEX AI Agent to Probe IT and Software Vendors for Supply Chain Access
• Token Replay Attack Hits 79 Organizations Through Stolen Microsoft 365 Sessions

The post Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,000 Credentials appeared first on Daily CyberSecurity.

Ransomware gangs exploit CVE-2026-0257, a GlobalProtect authentication bypass in PAN-OS, to slip past MFA and open VPN sessions. Patch now.

Related Posts:

• OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build
• AdFection Spyware Attack Targets Al Jazeera Devices
• GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps

The post Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access appeared first on Daily CyberSecurity.

Operation Master used a GlobalProtect flaw to steal utility data, then fed it into an invoice fraud platform that sent 2.4M+ fake bills in Brazil.

Related Posts:

• ShinyHunters Renews Oracle PeopleSoft Attacks With One-Character WAF Bypass
• Konni Launches Operation Conflict Compass Against Ukraine
• Kiteworks Mandates Global Precautionary Server Shutdown

The post Operation Master Turns GlobalProtect Breaches Into Brazilian Invoice Fraud appeared first on Daily CyberSecurity.

Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257.

The post Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42.