October 12, 2026
GlobalProtect Auth Bypass Becomes a Ransomware Initial-Access Path
Qilin and Settra ransomware crews are actively exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect, to establish unauthorized VPN sessions and gain initial access to victim networks. Kimsuky has expanded Operation GitPower against Ukrainian policy experts using malicious LNK files, PowerShell, and GitHub/GitLab infrastructure for C2 and exfiltration. Midnight Mimosa preinstalled Android malware with system-level privileges has been discovered in firmware on low-cost MediaTek phones across over 150 countries, silently installing applications and performing ad fraud. Password resets and session revocation in Microsoft 365 do not guarantee immediate containment of extant access tokens, requiring incident responders to investigate downstream activity and token expiry separately.