Unit 42 Threat Intelligence has identified five leading initial-access vectors observed during September 2026. Public-facing application exploitation led the list, followed by credential abuse, phishing, supply-chain compromise and drive-by attacks.
The findings describe patterns observed by Palo Alto Networks’ threat-intelligence team. They are not a count of every intrusion worldwide, nor proof that one organization experienced all five attack paths.
At a glance
- Exploitation of public-facing applications was the most frequent initial-access vector.
- Valid credentials and credential abuse formed a prevalent secondary route.
- Phishing remained a leading delivery method in targeted operations.
- Supply-chain compromise produced potentially broad, cascading consequences.
- Drive-by attacks required little more than a visit to a compromised or malicious site.
Edge exploitation came first
Unit 42 placed exploitation of public-facing applications at the top of its September list. Exposed web applications, database instances and perimeter services provided attackers with initial footholds that could become persistent.
For defenders, this is less useful as a trend label than as a testing instruction. Start with the assets that are actually reachable from the internet. Identify exposed services, compare them with intended versions and ask whether an attacker could gain a durable foothold through the interface itself.
The point is not to treat every internet-facing system as compromised. It is to stop assuming that perimeter controls will absorb opportunistic scanning. An exploitable edge service can remove the need for a convincing phish.
Credentials turn vulnerabilities into access
The second vector was the use of valid credentials and credential abuse. Attackers used pre-harvested, sprayed or illicitly obtained authentication material, often chained with edge-service vulnerabilities. Their goal was to bypass controls while blending into normal authentication activity.
That combination deserves attention because it changes the detection problem. A valid account may pass access checks, appear in expected locations and generate few obvious errors. If the account was acquired through a vulnerable service, the application logs may show a successful login without revealing the earlier compromise.
Identity telemetry must therefore be considered alongside vulnerability evidence. Review where credentials came from, how many accounts failed before succeeding and whether privileged access follows familiar paths. A patch without credential review may leave the attacker inside.
Social engineering still delivers the payload
Phishing and targeted social engineering remained the leading social-engineering vector. Unit 42 observed them across electronic messaging and browser-based lures, particularly in operations targeting public-sector, defense and regional enterprise environments.
The technique still works because credential theft and payload delivery can be combined in one interaction. A browser lure may lead to a convincing sign-in page, while a malicious message may deliver a payload. Teams should test both paths and look beyond the initial message.
A practical detection rule should cover the account compromise and the endpoint or session that follows it. Blocking obvious phishing domains helps, but it does not cover every lure or compromised sender account.
Supply chain and drive-by attacks widen the exposure
Supply-chain compromise was the high-impact systemic vector in Unit 42’s review. Targeted campaigns involving trusted relationships can create cascading consequences across connected organizations and sectors. One compromised supplier relationship can provide access that looks more legitimate than a direct intrusion.
Drive-by compromise was the specialized delivery vector. In these operations, a target’s visit to a compromised or malicious website triggers the attack without additional interaction. The user does not need to download an obvious file or approve a permission prompt.
These two paths differ in scale, but both expose a weakness in user-driven prevention. Identity and endpoint controls still matter after traffic reaches a browser. Web isolation, managed browser controls and telemetry for compromised sites can reduce the value of a drive-by lure.
Why this matters
The five vectors form a practical attack chain. Exposed infrastructure creates entry. Stolen credentials help attackers persist. Phishing supplies another route. Supply-chain trust broadens the target set. Drive-by delivery removes the final user action.
Defenders tend to organize around products, not paths. A vulnerability team owns the edge, an identity team owns accounts and a SOC team owns suspicious traffic. The problem crosses those boundaries. An initial foothold in one layer often determines what the next layer sees.
Unit 42’s list also argues against prioritization based on novelty. The leading vectors are established attack methods with operational advantages. They scale, blend into trusted activity and can exploit gaps between teams.
A practical validation exercise
Say you are testing a regional enterprise with a public application, remote-access users and a supplier that maintains a software component. Build one exercise around each available path without creating unnecessary risk.
For the edge, identify the application owner, patch status and remediation path for its exposed instance. For credentials, sample privileged accounts and determine whether impossible travel, unusual device use or anomalous service authentication would trigger an investigation. For phishing, confirm that a suspicious login can be correlated with the message that delivered it.
Then examine the supplier relationship: what access does that vendor have, how is it reviewed and how quickly would you learn of a compromised build? Finally, test whether your web controls can distinguish a visit to a known malicious destination from ordinary browsing without relying on the user to report it.
The output should be a short set of control gaps with owners and deadlines. A threat report that never changes a detection, patch or identity rule is shelfware.
What to watch next
Next month’s priority is not merely whether a new vector appears. Watch for combinations: edge exploitation followed by valid-account abuse, phishing that produces a privileged session, or supplier access that bypasses normal onboarding controls.
Unit 42’s September findings give security teams a clean way to test readiness. Verify that external assets can be patched, credentials can be revoked, phishing paths produce usable telemetry, supplier access can be constrained and risky sites can be contained. The edge led this month’s observations. It is also where most of that verification should begin.
Key takeaways
- Prioritize internet-facing services and management interfaces as the first layer of continuous validation.
- Correlate vulnerability events with identity activity so stolen credentials do not hide inside successful logins.
- Test supply-chain access and malicious-site containment alongside conventional patching and phishing controls.
Frequently asked questions
What was the leading initial-access vector in September 2026?
Unit 42 identified exploitation of public-facing applications as the primary and most frequent vector. Compromised web applications, database instances and perimeter services were recurring targets.
How did credential abuse support other attack methods?
Attackers combined stolen, sprayed or otherwise obtained credentials with edge-service vulnerabilities. This helped them bypass perimeter controls and resemble legitimate user activity.
Did drive-by compromise require users to install anything?
No. The described technique triggered system compromise when target traffic reached a compromised or malicious website, requiring no interaction beyond the visit.
How should security teams use Unit 42’s five-vector list?
Treat it as a validation framework. Test edge exposure, identity controls, phishing telemetry, supplier access and web containment, then assign the resulting gaps to clear owners. === END ===