✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
ShinyHunters Exploit SSO Vulnerabilities in 2026 Vishing Attacks
In January 2026, the cybercriminal group ShinyHunters orchestrated a series of sophisticated voice phishing (vishing) attacks targeting single sign-on (SSO) credentials across multiple organizations. By impersonating IT support personnel, they deceived employees into providing their SSO credentials and multi-factor authentication (MFA) codes on counterfeit login portals. This enabled unauthorized access to various connected SaaS applications, including Salesforce, Microsoft 365, and Slack, leading to significant data breaches. Notable companies such as Panera Bread, Crunchbase, and Betterment confirmed unauthorized access and data exfiltration resulting from these attacks. ([zerofox.com](https://www.zerofox.com/intelligence/flash-report-shinyhunters-sso-phishing-campaign/?utm_source=openai)) This incident underscores the evolving threat landscape where attackers combine social engineering with advanced phishing techniques to bypass MFA protections. The widespread adoption of SSO systems amplifies the potential impact of such breaches, as compromising a single account can grant access to multiple platforms. Organizations must enhance their security awareness training and implement robust monitoring to detect and mitigate such sophisticated attacks.
5 months ago
Kill Chain
Cloud Storage Payment Scam 2026: A Global Phishing Threat
In late 2025 and early 2026, a widespread phishing campaign targeted users globally with fraudulent emails claiming their cloud storage subscriptions were at risk due to payment failures. These emails, often personalized with the recipient's name, warned of imminent data loss and urged immediate action. Victims who clicked on the provided links were redirected to phishing sites mimicking legitimate cloud service portals, where they were prompted to enter sensitive information or make payments. The attackers exploited users' fears of losing valuable data to steal personal and financial information. This incident underscores the increasing sophistication of phishing attacks, particularly those leveraging social engineering tactics to impersonate trusted services. The prevalence of such scams highlights the critical need for heightened vigilance and robust cybersecurity measures to protect against evolving threats.
5 months ago
Kill Chain
ShinyHunters 2026 Vishing Attacks Breach SaaS Platforms
In January 2026, the financially motivated hacking group ShinyHunters orchestrated a series of sophisticated voice phishing (vishing) attacks targeting employees of various organizations. By impersonating IT staff, they directed victims to fraudulent credential harvesting sites, capturing Single Sign-On (SSO) credentials and Multi-Factor Authentication (MFA) codes. This access enabled them to infiltrate cloud-based Software-as-a-Service (SaaS) platforms, exfiltrating sensitive data and internal communications, which were subsequently used for extortion purposes. The campaign notably affected platforms such as Okta, Microsoft 365, and Google Workspace, compromising numerous organizations across multiple sectors. This incident underscores the evolving tactics of cybercriminals, highlighting the increasing sophistication of social engineering methods to bypass traditional security measures. The reliance on vishing and real-time phishing kits to exploit identity providers and SaaS platforms emphasizes the urgent need for organizations to adopt phishing-resistant MFA solutions and enhance employee training to recognize and respond to such threats.
5 months ago
Kill Chain
Aisle's AI Uncovers Decades-Old OpenSSL Vulnerabilities
In January 2026, Aisle's AI-assisted cybersecurity team uncovered 12 previously undetected vulnerabilities in the OpenSSL codebase, some dating back to 1998. These vulnerabilities, ranging from stack buffer overflows to encryption flaws, were promptly patched. The discovery underscores the limitations of human-only vulnerability detection and highlights the efficacy of AI-powered security tools in identifying longstanding security issues. This incident emphasizes the growing role of AI in cybersecurity, showcasing its potential to enhance threat detection and response capabilities. As AI-driven cyber threats become more sophisticated, integrating AI into security operations is increasingly vital for organizations aiming to protect their digital assets.
5 months ago
Kill Chain
Fortinet's 2026 Authentication Bypass Vulnerability: A Critical Security Alert
In January 2026, Fortinet disclosed a critical authentication bypass vulnerability (CVE-2026-24858) affecting multiple products, including FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb. This flaw allowed attackers with a FortiCloud account and a registered device to gain unauthorized access to other devices registered to different accounts, provided FortiCloud SSO authentication was enabled. Exploitation of this vulnerability led to unauthorized firewall configuration changes, creation of rogue administrator accounts, and potential data exfiltration. Fortinet responded by disabling FortiCloud SSO on January 26, 2026, and subsequently released patches to address the issue. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, urging immediate remediation. This incident underscores the critical importance of timely patch management and vigilant monitoring of authentication mechanisms to prevent unauthorized access and potential data breaches.
5 months ago
Kill Chain
Energy Sector Faces Sophisticated AiTM Phishing and BEC Attack in 2026
In January 2026, a sophisticated adversary-in-the-middle (AiTM) phishing and business email compromise (BEC) campaign targeted multiple organizations within the energy sector. Attackers exploited SharePoint's file-sharing services to distribute phishing payloads, leading to the compromise of numerous user accounts. The campaign involved creating malicious inbox rules to maintain persistence and evade detection, subsequently launching large-scale phishing attacks both internally and externally. This operation underscores the evolving complexity of AiTM campaigns and highlights the necessity for organizations to implement comprehensive remediation strategies beyond standard identity compromise responses. The incident serves as a critical reminder of the importance of robust security measures, including the revocation of active session cookies and the removal of unauthorized inbox rules, to effectively mitigate such threats.
5 months ago
Kill Chain
Moltbot AI Agent Security Breach: A Wake-Up Call for AI Security
In January 2026, the open-source AI assistant Moltbot, formerly known as Clawdbot, faced significant cybersecurity scrutiny due to its extensive access to user systems. Security researchers discovered hundreds of exposed or poorly secured Moltbot control panels accessible on the public internet, revealing private data such as API keys and allowing unauthorized command execution. Additionally, vulnerabilities like susceptibility to prompt injection attacks and AI hallucinations were identified, raising concerns about the potential for data breaches and system compromises. These findings underscore the critical need for robust security measures in the deployment of AI agents to prevent unauthorized access and data exposure. This incident highlights the growing risks associated with AI agents as they become more integrated into organizational processes. The ease of access and control they offer can inadvertently introduce significant security vulnerabilities if not properly managed. As AI technologies continue to evolve and see wider adoption, it is imperative for organizations to implement stringent security protocols and continuous monitoring to safeguard against emerging threats posed by AI agents.
5 months ago
Kill Chain
Critical LLM Vulnerability: System Prompt Extraction via Form Fields
In January 2026, security researchers identified a critical vulnerability in Large Language Models (LLMs) integrated into AI assistants. Despite implementing architectural constraints to restrict chatbots to templated responses, attackers exploited the models' ability to populate form fields, enabling the extraction of system prompts. This method allowed unauthorized access to sensitive information, bypassing traditional output restrictions. The incident underscores the evolving nature of prompt injection attacks and the necessity for comprehensive security measures in AI deployments. As AI integration becomes more prevalent, understanding and mitigating such vulnerabilities is crucial to maintaining data integrity and user trust.
5 months ago
Kill Chain
Meta AI's 2024 Chatbot Vulnerability Exposes User Data
In December 2024, a critical vulnerability was discovered in Meta AI's chatbot platform, allowing unauthorized users to access private prompts and AI-generated responses of other users. The flaw involved manipulating unique identifiers in the browser's network traffic, enabling access to others' chatbot interactions without proper permission checks. Meta was notified on December 26, 2024, and patched the vulnerability by January 24, 2025. There was no evidence of the flaw being exploited in the wild. This incident underscores the importance of securing AI chatbot platforms against unauthorized access, especially as they handle sensitive user data. Organizations must implement robust authorization mechanisms and regularly audit their systems to prevent similar vulnerabilities.
5 months ago
Kill Chain
Vivaldi Webmail Phishing Attack Exploits Google Presentations - January 2026
In January 2026, a phishing campaign targeted Vivaldi Webmail users by exploiting Google Presentations to bypass security measures. Attackers sent emails containing links to Google Slides presentations, which, when accessed, redirected users to fraudulent login pages designed to harvest credentials. This method effectively circumvented traditional phishing detection mechanisms by leveraging trusted platforms. The incident underscores a growing trend where cybercriminals abuse legitimate services to execute phishing attacks, highlighting the need for enhanced vigilance and adaptive security strategies to counteract evolving threats.
5 months ago
Kill Chain
Introducing Julius: Enhancing AI Security with LLM Service Fingerprinting
In January 2026, Praetorian released Julius, an open-source tool designed to identify and fingerprint Large Language Model (LLM) services across corporate networks. Julius enables security teams to detect various LLM services, such as Ollama, LiteLLM, and Open WebUI, by analyzing endpoints and extracting information about the models in use. This tool addresses the growing challenge of unmanaged and potentially insecure LLM deployments within organizations, which can be exploited by attackers for unauthorized access, data exfiltration, or lateral movement within networks. The release of Julius is particularly timely given the increasing integration of LLMs into enterprise environments and the associated security risks. Recent incidents have highlighted vulnerabilities in LLM applications, including prompt injection attacks and data leakage, underscoring the need for robust detection and monitoring tools like Julius to enhance organizational security postures.
5 months ago
Kill Chain
Critical Zero-Day Vulnerabilities in Ivanti EPMM Exploited
In January 2026, Ivanti disclosed two critical zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) software, identified as CVE-2026-1281 and CVE-2026-1340, each with a CVSS score of 9.8. These code injection flaws allow unauthenticated remote attackers to execute arbitrary code on affected systems, potentially leading to unauthorized access to sensitive data and system configurations. Ivanti confirmed active exploitation of these vulnerabilities in a limited number of customer environments at the time of disclosure. ([crn.com](https://www.crn.com/news/security/2026/ivanti-critical-mobile-management-vulnerabilities-seeing-exploitation?utm_source=openai)) The exploitation of these vulnerabilities underscores the persistent threat posed by zero-day attacks targeting enterprise management systems. Organizations are urged to apply the available patches promptly to mitigate the risk of unauthorized access and potential data breaches. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ivanti-warns-of-two-epmm-flaws-exploited-in-zero-day-attacks/?utm_source=openai))
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports