✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
VMware vCenter RCE Flaw Actively Exploited: What Security Teams Need to Know
In January 2026, a critical vulnerability (CVE-2024-37079) in VMware vCenter Server was confirmed as actively exploited in the wild. This heap overflow flaw within the DCERPC protocol implementation enables unauthenticated remote attackers with network access to execute arbitrary code on vulnerable vCenter Server systems. The compromise does not require user interaction or elevated privileges, making attacks relatively low-effort and high-impact. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive mandating all federal agencies to remediate the issue within three weeks, underscoring its urgency and operational risk. No temporary mitigations exist, leaving patching as the sole defense for affected environments. This incident highlights a continued trend of attackers targeting management and orchestration layers in hybrid-cloud and virtualized infrastructures. The lack of workarounds, combined with rapid weaponization, points to increasing risks for organizations who delay patching and underlines regulatory pressure on timely remediation for critical zero-day vulnerabilities.
6 months ago
Kill Chain
NPM Supply Chain Bypass: PackageGate and Shai-Hulud Exploits Expose Open-Source Risks in 2026
In January 2026, critical vulnerabilities dubbed "PackageGate" were revealed in NPM and several popular JavaScript package managers, exposing gaps in defenses against supply chain attacks like last year's Shai-Hulud incidents. Despite previous security improvements, attackers could still bypass NPM's safeguard against malicious package scripts by leveraging Git dependencies and malicious .npmrc configuration files, leading to unauthorized code execution—even when script blocking features were enabled. The flaws, discovered by Koi Security researchers, allowed full code compromise and had potential for massive developer credential and secret exfiltration, threatening tens of thousands of projects and their downstream users. These findings highlight the persistent risks in open-source supply chains and the accelerating pace of software supply chain attacks. As threat actors become more adept at exploiting package management tools, organizations face renewed urgency to bolster visibility, enforce granular access controls, and adopt defense-in-depth measures to protect development workflows and critical assets.
6 months ago
Kill Chain
Microsoft Patches Active Office Zero-Day: What Your Security Team Must Know
In June 2024, Microsoft urgently released security patches addressing a high-severity zero-day vulnerability in Microsoft Office. Threat actors exploited this flaw in-the-wild prior to disclosure, using malicious documents to achieve remote code execution and gain access to targeted systems without user awareness. The vulnerability impacted multiple Office versions, with proof-of-concept exploits circulating even before patch release. Microsoft’s security teams identified active exploitation, prompting swift response to curb potential corporate data exposure, loss of confidentiality, and operational disruption for both private and public sector users worldwide. This incident spotlights the persistent risk of zero-day exploits in mainstream productivity software. It underscores both attackers’ increasing sophistication in rapidly weaponizing new vulnerabilities and the escalating need for organizations to prioritize timely patch application and robust monitoring to mitigate the business impact of emerging threats.
6 months ago
Kill Chain
Malicious AI-Powered VS Code Extensions Trigger Global Supply Chain Breach (2026)
In January 2026, cybersecurity researchers uncovered that two widely-distributed AI-powered Microsoft Visual Studio Code extensions, with over 1.5 million combined installs, were covertly exfiltrating developer source code and sensitive project data to servers based in China. The malicious extensions masqueraded as legitimate AI coding tools, enticing developers globally through the official VS Code marketplace. Once installed, these extensions surreptitiously uploaded confidential code and intellectual property, potentially endangering enterprise software assets and customer data. Investigators highlighted the supply chain risk, noting the threat’s scalability via trusted software distribution channels and the delays in detecting such activity. This incident underscores the escalating risks associated with third-party development tools, particularly those leveraging AI branding. The popularity and trust in official marketplaces can allow sophisticated advanced persistent threats (APTs) or criminal groups to exploit developers and organizations, necessitating enhanced scrutiny and continuous security monitoring of supply chain dependencies.
6 months ago
Kill Chain
Exposed Environment Files: The $(pwd) Webserver Reconnaissance Surge of Jan 2026
In January 2026, multiple sensors and the SANS Internet Storm Center reported a wave of targeted web application scans probing for exposed environment and configuration files on webservers using the /$(pwd)/ path pattern. Attackers, active since at least January 13th, systematically searched for sensitive files such as .env, docker-compose.yml, and terraform.tfstate, potentially exposing credentials and secrets. Two identified IP addresses (185.177.72.52, 185.177.72.23) led these scans, illustrating an automated approach likely leveraging misconfigured servers. While no confirmed breaches have been disclosed, such activity significantly raises the risk of follow-on exploitation or credential theft if vulnerable files are found. This incident highlights growing attacker sophistication in discovering misconfigurations and automating reconnaissance. The use of predictable directory traversal patterns and attempts to surface hidden files underscore the need for robust web application hardening and monitoring, especially as threat actors increasingly leverage similar tactics to bypass traditional defenses.
6 months ago
Kill Chain
ShinyHunters 2026: SSO Vishing Attacks Trigger Major SaaS Data Breaches
In January 2026, the cybercriminal group ShinyHunters orchestrated a series of sophisticated voice-phishing (vishing) attacks targeting corporate Single Sign-On (SSO) platforms, including Okta, Microsoft Entra, and Google. The attackers posed as IT support staff, manipulated employees into entering their credentials and multi-factor authentication tokens on fake login pages, and subsequently gained unauthorized access to SSO accounts. Leveraging these credentials, ShinyHunters accessed numerous connected SaaS applications such as Salesforce, Microsoft 365, and Slack, harvesting sensitive corporate data that was later used for extortion demands. High-profile organizations like SoundCloud, Betterment, and Crunchbase reported breaches and data losses as a result. This incident underscores a significant evolution in social engineering tactics, with attackers combining real-time phishing kits and vishing to bypass MFA and access a wide swath of corporate resources. As threat actors increasingly exploit identity-driven weaknesses and leverage SSO misconfigurations, organizations face greater risks of multi-system compromise and regulatory fallout.
6 months ago
Kill Chain
Russian Organizations Hit by Advanced Multi-Stage Phishing with Amnesia RAT and Ransomware
In January 2026, a sophisticated multi-stage phishing campaign targeted Russian organizations, leveraging social engineering emails that contained tampered business documents. These lures delivered a remote access trojan (Amnesia RAT) alongside ransomware, allowing attackers to establish stealthy persistence and ultimately encrypt sensitive data for extortion. The threat actors employed layered infection chains, executed lateral movement within infected environments, and exfiltrated critical information before deploying ransomware. The attack resulted in operational disruptions and financial risk for affected businesses. This incident reflects an escalating trend of multi-vector threats where initial phishing access rapidly pivots to advanced malware implants and ransomware. Security leaders must recognize the evolving sophistication and automation in phishing and malware delivery, and reinforce layered defenses, monitoring, and incident response to counter multi-stage cyber attacks.
6 months ago
Kill Chain
CISA Urgently Flags Critical VMware vCenter Vulnerability (CVE-2024-37079) Amid Active Exploitation
In June 2024, a critical heap overflow vulnerability (CVE-2024-37079) affecting Broadcom VMware vCenter Server was identified and patched, but active exploitation was confirmed shortly thereafter. On January 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog after evidence surfaced of attackers leveraging the bug to execute unauthorized code remotely. Malicious actors could use this exploit to gain privileged access, conduct lateral movement, and potentially exfiltrate sensitive data or disrupt operations in environments utilizing unpatched vCenter servers. The incident underscores the continued targeting of core virtualization infrastructure by sophisticated threat actors and ransomware groups. With threat actors rapidly exploiting newly disclosed vulnerabilities, unpatched critical systems are at heightened risk, prompting urgency for patch management and layered security controls across enterprise environments.
6 months ago
Kill Chain
Cisco Zero-Day Flaw Sparks Mass Exploitation of Unified Communications Platforms
In early June 2026, Cisco disclosed a critical zero-day vulnerability (CVE-2026-20045) impacting its Unified Communications (UC) suite, which quickly became the target of mass automated exploitation. Threat actors leveraged the flaw to gain remote code execution, potentially allowing them to fully compromise UC servers and pivot into broader enterprise networks. The scale of the vulnerability—affecting millions of devices worldwide—prompted urgent alerts from security agencies and rapid patching actions by global organizations. Successful intrusions could enable attackers to intercept sensitive communications, exfiltrate data, and disrupt business operations. This incident is especially notable as zero-day attacks against high-availability collaboration infrastructure have surged, reflecting a broader trend in targeting business-critical communication platforms. The Cisco exploitation underscores the speed at which adversaries now weaponize new flaws, and the risks posed to organizations lacking robust patch and segmentation defenses.
6 months ago
Kill Chain
Fortinet FortiCloud Auth Bypass: Patched Firewalls Remain at Risk in 2026
In January 2026, Fortinet confirmed the existence of a critical authentication bypass (CVE-2025-59718) affecting its FortiCloud SSO feature, leaving fully patched devices vulnerable to compromise. Attackers exploited a patch bypass to gain administrative access, quickly creating VPN-enabled accounts and exfiltrating firewall configurations. Despite an earlier advisory, threat actors continued to exploit an unaddressed attack path, with the campaign becoming automated and impacting organizations globally. Evidence included unauthorized logins and suspect account creation, prompting urgent investigation and forensic response from network teams. This breach illustrates the growing risk posed by incomplete patches and the relentless pursuit by attackers of residual vulnerabilities, particularly in widely deployed network security products. It underscores the critical need for continuous monitoring, rapid patch validation, and limiting administrative access to sensitive management interfaces.
6 months ago
Kill Chain
Malicious AI Extensions in VSCode Marketplace Steal Developer Data, Impacting 1.5 Million Users
In January 2026, researchers at Koi Security discovered that two AI-powered Visual Studio Code (VSCode) Marketplace extensions—ChatGPT – 中文版 and ChatMoss (CodeMoss)—were secretly exfiltrating developer files and sensitive data to China-based servers. Together, these malicious extensions had been installed 1.5 million times and collected data using real-time file monitoring, workspace file harvesting, and covert user profiling via embedded commercial analytics SDKs. The compromised extensions transmitted not only source code but potentially included API keys, configuration, and credential files without user consent, representing a major supply-chain compromise in the software development ecosystem. This incident highlights the persistent risks developers face from supply chain attacks through third-party plugins. As AI-driven code assistants surge in popularity, attackers are increasingly exploiting trusted extension marketplaces to deploy sophisticated data-stealing campaigns, raising urgent concerns for software security, compliance, and marketplace governance.
6 months ago
Kill Chain
AI-Generated Code Exposes New Honeypot Security Risks at Intruder (2026)
In January 2026, Intruder Security revealed an application security vulnerability in their intentionally vulnerable honeypot, stemming from AI-generated code that mishandled client-supplied IP headers. The AI-assisted system incorrectly trusted IP values in HTTP headers without enforcing a trust boundary, allowing attackers to inject payloads or spoof source IP information. This oversight, undetected by common static analysis tools, resulted in attacker-controlled inputs influencing system logic, posing potential risks for local file disclosure or server-side request forgery had the vulnerable code path been used differently. While the actual impact remained low due to the isolated nature of the honeypot, the incident highlights significant gaps in current AI-assisted development and security review processes. This event underscores the growing prevalence of AI-generated vulnerabilities and the limitations of automated security tools in identifying nuanced flaws. As enterprises increasingly rely on AI-driven coding and automation, such oversights are likely to become more common, emphasizing the need for robust validation and updated security governance.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports