Workspace ONE is a technology platform tracked across 3 threat clusters and 4 intelligence report mentions on ThreatCluster. First observed November 3, 2025; most recent activity April 30, 2026.
Workspace ONE is VMware's enterprise platform for digital workspace management, integrating identity, app delivery, and Unified Endpoint Management (UEM) to manage devices and applications across multiple platforms. Its MDM capabilities enable centralized control of enrolled endpoints, which can be a double-edged sword in security if misused. The Airstalk incident illustrates how legitimate MDM tooling can be repurposed to create covert spy channels, highlighting a significant risk vector for organizations relying on Workspace ONE for device management.
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding active exploitation of vulnerabilities in Ivanti Endpoint Manager, SolarWinds Web Help Desk, and VMware Workspace ONE. The…
Palo Alto Networks’ Unit 42 has identified a new malware campaign named Airstalk, linked to a suspected nation-state actor. This malware targets mobile device management tools, specifically leveraging the AirWatch API…
Forrester has announced the retirement of its Endpoint Security Wave report series in 2026, citing the convergence of Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) solutions. This…