Unit 42

Everything Sandbox Dispatch has reported about Unit 42: 2 stories, newest first. Part of our Malware & Ransomware coverage.

Cyber Attacks

How do phishing and LLMs enable OAuth theft to bypass MFA checks and grant persistent access?

Attackers are shifting from credential theft to stealing OAuth tokens, allowing them to bypass multi-factor authentication and maintain durable access to enterprise data.

Oct 22, 2026

Malware & Ransomware

How PEERSTITCH Implant Hides in FortiGate Memory Without Files or Ports

A memory-only ARM64 implant hijacks legitimate FortiOS processes, leaving no executables or open ports to detect on targeted firewalls.

Oct 15, 2026