Massive Attacks Targeting Palo Alto PAN-OS GlobalProtect Portals from 2,200 IPs

Cybersecurity researchers have spotted a dramatic upswing in malicious scanning targeting Palo Alto Networks PAN-OS GlobalProtect login portals, with attacks now originating from over 2,200 unique IP addresses as of 7 October 2025. This marks a sharp rise from around 1,300 IPs observed on 3 October, illustrating a rapidly evolving, coordinated campaign.

The activity suggests a consistent pattern of credential stuffing, where attackers test compromised username and password combinations across the GlobalProtect login infrastructure. GreyNoise researchers have noted that the increasing diversity of ASN subnets involved points to broadening operator involvement, possibly indicating multiple threat actors or a single sophisticated operation using distributed infrastructure.

Organisations should review authentication logs, bolster monitoring for suspicious login attempts, and consider stronger measures such as multi-factor authentication and geographic access restrictions to defend internet-facing PAN-OS GlobalProtect components.