✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Critical Vulnerabilities in Major Password Managers Expose Millions
In February 2026, researchers from ETH Zurich and Università della Svizzera italiana identified 25 critical vulnerabilities across three major password managers: Bitwarden, LastPass, and Dashlane. These flaws, affecting over 60 million users, were categorized into key escrow mechanisms, item-level vault encryption, sharing features, and backward compatibility issues. Exploiting these vulnerabilities could allow attackers to bypass zero-knowledge encryption claims, leading to unauthorized access and modification of users' stored passwords and vault data. ([cybersecuritynews.com](https://cybersecuritynews.com/password-managers-vulnerability/?utm_source=openai)) The study underscores the ongoing challenges in balancing security and user convenience in password management solutions. While the affected companies have begun implementing fixes, the incident highlights the necessity for continuous evaluation and enhancement of security protocols to protect sensitive user information.
5 months ago
Kill Chain
Arkanix Stealer: A Brief Yet Impactful AI-Assisted Malware Campaign
In late 2025, the Arkanix Stealer emerged as an AI-assisted information-stealing malware, promoted on dark web forums and distributed through Discord channels. The malware targeted Windows systems, employing advanced evasion techniques to bypass security controls. It harvested sensitive data, including browser credentials, cryptocurrency wallets, VPN accounts, and system metadata, which was then exfiltrated to attacker-controlled infrastructure. The operation was short-lived, with the author dismantling the control panel and Discord server within two months, suggesting a quick financial gain motive. This incident underscores the growing trend of cybercriminals leveraging AI to rapidly develop and deploy sophisticated malware, reducing development time and costs. The swift emergence and disappearance of such threats pose significant challenges for detection and mitigation, highlighting the need for continuous vigilance and adaptive security measures.
5 months ago
Kill Chain
AI-Powered Cyberattack Compromises 600 Fortinet Firewalls in 2026
Between January 11 and February 18, 2026, a Russian-speaking threat actor utilized generative AI services to compromise over 600 FortiGate firewalls across 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking multi-factor authentication, without leveraging any known vulnerabilities. Once access was gained, AI-assisted tools were employed to automate reconnaissance, extract configurations, and facilitate lateral movement within the networks. This campaign underscores the evolving threat landscape where AI technologies are being harnessed to amplify the capabilities of less sophisticated attackers, enabling them to execute large-scale intrusions with increased efficiency. Organizations must prioritize fundamental security measures, including securing management interfaces, enforcing strong authentication protocols, and maintaining vigilant monitoring to mitigate such AI-augmented threats.
5 months ago
Kill Chain
CISA Highlights Critical Roundcube Vulnerabilities Amid Active Exploitation
In February 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities affecting Roundcube webmail software to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. The first, CVE-2025-49113, is a deserialization flaw allowing remote code execution by authenticated users due to improper validation of the '_from' parameter in 'upload.php'. The second, CVE-2025-68461, is a cross-site scripting vulnerability via the 'animate' tag in SVG documents. Both vulnerabilities have been exploited by threat actors, including nation-state groups like APT28 and Winter Vivern, to steal login credentials and spy on sensitive communications. ([thehackernews.com](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV catalog underscores the persistent targeting of webmail platforms by sophisticated adversaries. Organizations using Roundcube are urged to apply the latest security patches promptly to mitigate potential risks. ([thehackernews.com](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html?utm_source=openai))
5 months ago
Kill Chain
Predator Spyware's Stealthy Bypass of iOS Recording Indicators
In February 2026, security researchers uncovered that Intellexa's Predator spyware can suppress iOS's camera and microphone recording indicators, allowing covert surveillance without user awareness. By injecting code into SpringBoard, the spyware intercepts sensor activity updates, preventing the green and orange dots from appearing when the camera or microphone is active. This technique requires prior full device compromise, including kernel-level access, and does not exploit new iOS vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/predator-spyware-hooks-ios-springboard-to-hide-mic-camera-activity/?utm_source=openai)) This discovery highlights the evolving sophistication of commercial spyware and underscores the importance of maintaining up-to-date device security measures. Users should be aware that visual indicators alone may not reliably signal unauthorized access to device sensors, emphasizing the need for comprehensive security practices.
5 months ago
Kill Chain
AI-Assisted Cyber Attack Compromises 600+ FortiGate Devices in 2026
Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor exploited exposed management ports and weak credentials to compromise over 600 FortiGate devices across 55 countries. Utilizing commercial generative AI tools, the attacker automated scanning for vulnerable devices and executed authentication attempts, leading to unauthorized access and potential data exfiltration. This incident underscores the growing trend of cybercriminals leveraging AI to scale operations, enabling even low-skilled actors to conduct widespread attacks. Organizations must prioritize securing management interfaces, enforcing strong authentication mechanisms, and monitoring for unauthorized access to mitigate such threats.
5 months ago
Kill Chain
Starkiller Phishing Kit: A New Era of MFA Bypass Attacks
In February 2026, cybersecurity researchers uncovered 'Starkiller,' a sophisticated phishing-as-a-service platform developed by the cybercrime group Jinkusu. Unlike traditional phishing kits that use static replicas of login pages, Starkiller employs a headless Chrome browser within a Docker container to proxy live login pages of targeted brands such as Microsoft, Google, and Apple. This method allows attackers to capture user credentials, including multi-factor authentication (MFA) codes, in real-time by acting as a man-in-the-middle between the victim and the legitimate site. The platform offers features like keylogging, session token theft, geo-tracking, and real-time session monitoring, all accessible through an intuitive dashboard that lowers the technical barrier for cybercriminals. ([krebsonsecurity.com](https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/?utm_source=openai)) The emergence of Starkiller signifies a significant escalation in phishing tactics, reflecting a broader trend toward commoditized, enterprise-style cybercrime tooling. Its ability to bypass MFA protections and its user-friendly interface make it a potent tool for attackers, necessitating a shift in defensive strategies toward behavioral detection and identity-aware analysis to effectively counter such advanced threats. ([darkreading.com](https://www.darkreading.com/threat-intelligence/starkiller-phishing-kit-mfa?utm_source=openai))
5 months ago
Kill Chain
React2Shell Exploitation 2025: A Wake-Up Call for Web Security
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed in React Server Components, affecting versions 19.0 through 19.2.0. This flaw allowed unauthenticated remote code execution via crafted HTTP requests. Within hours of disclosure, state-sponsored threat actors, including Chinese groups Earth Lamia and Jackpot Panda, as well as North Korean operatives, began exploiting the vulnerability to deploy malware, establish persistent backdoors, and conduct cyber-espionage activities. The widespread use of React in web applications amplified the impact, leading to numerous system compromises across various sectors. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai)) The rapid exploitation of React2Shell underscores the increasing speed at which threat actors weaponize newly disclosed vulnerabilities. Organizations are urged to prioritize timely patching and enhance monitoring to mitigate risks associated with such critical flaws.
5 months ago
Kill Chain
AI-Powered Cyberattack Compromises Hundreds of FortiGate Devices Globally
Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor leveraged commercial generative AI services to compromise over 600 FortiGate devices across more than 55 countries. The attackers exploited exposed management ports and weak, single-factor authentication credentials, without utilizing any known FortiGate vulnerabilities. This campaign enabled the threat actor to extract full device configurations, including credentials and network topology information, facilitating further post-exploitation activities such as Active Directory compromise and credential harvesting. ([aws.amazon.com](https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/?utm_source=openai)) This incident underscores the evolving threat landscape where AI tools lower the technical barrier for cybercriminals, allowing even those with limited skills to execute large-scale attacks. Organizations must prioritize fundamental security measures, including securing management interfaces, enforcing strong authentication protocols, and maintaining vigilant monitoring to detect and respond to such AI-augmented threats.
5 months ago
Kill Chain
Roundcube 2025 Remote Code Execution Vulnerability
In June 2025, a critical vulnerability (CVE-2025-49113) was identified in Roundcube Webmail versions prior to 1.5.10 and 1.6.11. This flaw allowed authenticated users to execute arbitrary code on the server due to improper validation of the '_from' parameter in the 'upload.php' script, leading to PHP object deserialization. Exploitation of this vulnerability could result in complete server compromise, unauthorized access to sensitive email data, and potential lateral movement within the network. ([feedly.com](https://feedly.com/cve/CVE-2025-49113?utm_source=openai)) The discovery of this vulnerability underscores the importance of rigorous input validation and prompt patch management. Organizations using affected versions of Roundcube Webmail are urged to upgrade to the latest versions to mitigate potential exploitation risks.
5 months ago
Kill Chain
UMMC Ransomware Attack Disrupts Healthcare Services in Mississippi
In February 2026, the University of Mississippi Medical Center (UMMC) experienced a significant ransomware attack that led to the closure of all its clinics statewide and the cancellation of elective procedures. The cyberattack compromised multiple IT systems, including the Epic electronic medical records platform, necessitating the implementation of downtime procedures to maintain patient care. Emergency services remained operational, but the disruption affected numerous outpatient services and appointments. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/university-of-mississippi-medical-center-closes-clinics-after-ransomware-attack/?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting healthcare institutions, highlighting the critical need for robust cybersecurity measures to protect sensitive patient data and ensure the continuity of medical services.
5 months ago
Kill Chain
BeyondTrust 2026 RCE Vulnerability Exploited in Ransomware Attacks
In early February 2026, BeyondTrust disclosed a critical pre-authentication remote code execution (RCE) vulnerability, CVE-2026-1731, affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. This flaw allows unauthenticated attackers to execute arbitrary operating system commands by sending specially crafted requests to vulnerable endpoints. Despite the release of patches, active exploitation began almost immediately, with threat actors deploying ransomware and exfiltrating data. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on February 13, 2026, emphasizing the urgency for organizations to apply the necessary updates. The rapid exploitation of CVE-2026-1731 underscores a concerning trend where attackers swiftly leverage newly disclosed vulnerabilities to launch ransomware campaigns. This incident highlights the critical need for organizations to implement robust patch management processes and maintain vigilant monitoring to detect and respond to such threats promptly.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports