Attackers launch dual campaign on GlobalProtect portals and SonicWall APIs

A hacking campaign is targeting Palo Alto GlobalProtect portals with login attempts and scanning SonicWall SonicOS API endpoints since December 2, 2025.

A hacking campaign is targeting GlobalProtect logins and scannig SonicWall APIs since December 2, 2025. A campaign began on December 2 targeting Palo Alto GlobalProtect portals with login attempts and scanning SonicWall SonicOS API endpoints. The activity cam…