Unit 42 Threat Bulletin - February 2026
Summary: Unit 42's February 2026 Threat Bulletin describes three shifts: vibe coding that accelerates development beyond formal governance, malicious QR codes that trigger logins, payments and malware downloads inside trusted apps, and LLM-generated browser-based phishing that only becomes malicious at runtime. Unit 42 researchers state that AI does not understand intent, business logic or risk, that each phishing victim receives a unique page generated by LLMs with no fixed file, domain or payload to detect, and that blocking AI tools does not stop use because people copy results into approved systems.
What's compelling: Unit 42's own researchers say AI can generate code faster than review and governance processes can keep up, so insecure logic can reach production before security teams see it - and that people will route around any block you put on the tools. The phishing finding removes the artifact your email and network controls were built to catch: there is nothing fixed to detect until the page runs in a user's browser.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026