Image: Palo Alto Networks Unit 42
Internet-facing applications and abused login details were the leading ways attackers gained an initial foothold in incidents observed during September 2026. The findings matter to organizations running public services, while home users should pay particular attention to phishing and account security.
Exposed services were the main entry point
Palo Alto Networks Unit 42 ranked exploitation of public-facing applications as the most frequent initial access route it observed. Attackers targeted exposed web apps, databases and perimeter services to establish a persistent foothold.Valid credentials ranked second. Attackers used previously collected, guessed through password spraying, or illicitly obtained login details, sometimes combining them with flaws in edge services so their activity resembled normal account use.
- Review which applications and services are reachable from the internet, and promptly install security updates supplied by their vendors.
- Use unique passwords and enable multi-factor authentication where available to reduce the value of stolen credentials.
Phishing remained a leading social route
Phishing and targeted social engineering placed third. Unit 42 said attackers used messages and browser-based lures mainly to steal credentials or run malicious payloads, particularly against public-sector, defense and regional enterprise targets.Users should avoid entering a password after following an unexpected link. Open the service through a saved bookmark or its known app instead, and report suspicious work messages to the organization’s security team.
Trusted suppliers and websites carried wider risks
Supply-chain compromise ranked fourth and can spread through trusted business relationships, creating knock-on effects across multiple critical industries. This route was less general than the top entries but carried potentially widespread consequences.Drive-by compromise and watering-hole attacks ranked fifth. In these attacks, visiting a malicious or compromised website can trigger exploitation without further interaction from the visitor.
- Keep browsers, operating systems and browser extensions updated to reduce exposure to website-delivered exploits.
- Organizations should assess security notices from important software suppliers and service providers, especially when a compromise could affect connected systems.
