Detecting Malicious Campaigns with Machine Learning
Summary: Unit 42 described using unsupervised machine learning to cluster domains from passive DNS records, then flagging any cluster containing a significant share of verified malicious seed domains as a campaign. In one phishing campaign using names like check-box-with-money##[.]loan, the team found 333 active domains, of which 247 were unknown to a popular online malware database on day one and 240 remained unflagged after two weeks.
What's compelling: The best-performing block list in that campaign still missed 86 of 333 domains after two weeks, and across 15 campaigns covering over 1,000 domains the team found domains an average of 2.8 days before one malware database and up to 46 days earlier at the maximum - a window in which attackers count on the unflagged remainder getting through.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026