✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Multi-Vector Breach: npm Worm, Firefox RCE, and M365 Email Raids Rock 2025
In December 2025, a coordinated multi-vector cyberattack was observed targeting organizations through the exploitation of critical zero-day vulnerabilities (CVEs), a resurgence of the npm InfoStealer Worm, a remote code execution flaw in Mozilla Firefox, and widespread credential compromise leading to Microsoft 365 email account takeovers. Attackers leveraged a blend of social engineering, poisoned open-source packages, and malicious links to infiltrate developer environments, gain access to corporate cloud accounts, and spread laterally via trusted supply chains. Impacted organizations faced the risk of sensitive data exfiltration, widespread internal compromise, and disruption of core IT services across software development and communications. This incident underscores the growing sophistication and scale of modern attack campaigns that blend supply chain, RCE, SaaS compromise, and worm tactics. The convergence of these vectors highlights the urgent need for zero trust segmentation, continuous threat detection, and cloud-specific defenses as attackers increasingly target developer and business collaboration tools.
6 months ago
Kill Chain
ShadyPanda: The 2024 Browser Extension Supply Chain Breach Impacting 4.3 Million Installs
In mid-2024, the threat actor group ShadyPanda executed a sophisticated supply chain attack by compromising five popular browser extensions, which had previously been legitimate and widely trusted. These extensions, with a cumulative total of over 4.3 million installs, were maliciously updated to include spyware functionality, enabling covert surveillance and data exfiltration from unsuspecting users. The malicious modifications went undetected for several months, enabling the attackers to harvest browser data, credentials, and potentially sensitive user files, impacting organizations and individuals globally before the extensions were finally removed following a report by Koi Security. This incident highlights the increasing trend of supply chain compromise via browser extension ecosystems, which often lack sufficient vetting and monitoring. The attack underscores growing regulatory and operational pressure to secure third-party components and software supply chains, especially as similar tactics proliferate across widely adopted digital platforms.
6 months ago
Kill Chain
Shai-hulud: npm Supply Chain Attack Hits Cloud Ecosystem
In early 2024, security researchers uncovered a major supply chain attack involving a new variant of the Shai-hulud malware worm, which propagated through poisoned npm packages targeting cloud-based development environments. The malware autonomously infiltrated thousands of systems, harvesting credentials and secrets from cloud infrastructure providers including AWS, Google Cloud Platform, and Azure. Attackers achieved persistence and lateral movement by exploiting weaknesses in east-west traffic controls, leveraging the npm ecosystem’s trust to escalate impact across enterprise CI/CD pipelines and critical workloads. The breach resulted in significant operational risks, requiring emergency remediation from affected organizations and cloud providers. This incident highlights the evolving sophistication of supply chain threats, especially in cloud-native environments where development speed often outpaces traditional security controls. Attackers are increasingly abusing open-source package repositories for automated, scalable attacks—raising concerns for both cloud security and compliance teams.
6 months ago
Kill Chain
November 2025 Cybersecurity Review: Akira, Operation Endgame, and AI Data Exposure
In November 2025, the cybersecurity landscape was rocked by a surge of major incidents spanning data exposure at leading AI companies, a high-profile ransomware campaign by the Akira gang, and an unprecedented law enforcement operation targeting prolific malware families. Attackers leveraged advanced lateral movement and encryption bypass techniques, with Akira exfiltrating critical business data and setting new records for ransom hauls. Meanwhile, Operation Endgame—an international collaborative effort—dismantled several prominent malware botnets, arresting key operators and seizing digital infrastructure, all while organizations scrambled to contain threats and patch vulnerabilities across multi-cloud and hybrid environments. This period highlights a convergence of advanced extortion, data privacy, and large-scale coordinated response, reflecting escalating threat sophistication and the increasing pressure on organizations to meet evolving compliance and security demands.
6 months ago
Kill Chain
AI-Fueled LLMs Put Advanced Attacks in Reach for Novice Hackers (2024)
In early 2024, cybersecurity researchers observed a surge in the use of malicious, unrestricted large language models (LLMs) such as WormGPT 4 and KawaiiGPT. These AI-powered tools have been weaponized to generate sophisticated attack scripts—including ransomware encryptors and custom code for lateral movement—allowing even low-skilled threat actors to execute complex cyberattacks. Access to these malicious LLMs was facilitated via underground markets, democratizing advanced techniques and increasing the frequency and complexity of attacks targeting organizations across multiple sectors. This incident underscores a growing trend where AI-enabled cyber threats lower the barrier to entry for attackers. As malicious LLMs gain capabilities and proliferation increases, organizations face heightened risks from a new wave of adversaries and must adapt their defenses to address evolving, AI-driven tactics.
6 months ago
Kill Chain
Over 17,000 Secrets Exposed: Inside the 2024 GitLab Public Repository Incident
In early 2024, a security engineer conducting a large-scale scan of all 5.6 million public repositories hosted on GitLab Cloud uncovered more than 17,000 exposed secrets—such as API keys, credentials, and tokens—affecting over 2,800 unique domains. Although the incident did not involve a targeted cyberattack, the finding highlights the pervasive risk of accidental data exposure due to developer error or misconfiguration. The exposed secrets could have enabled threat actors to access sensitive services, launch attacks, or exfiltrate data unnoticed, exposing organizations to operational risk, reputational harm, and regulatory scrutiny. This discovery signals a growing trend as attackers increasingly automate scans for leaked credentials in public code repositories. With supply chain attacks, shadow IT, and cloud misconfigurations rising, such incidents underscore the urgency for automated secret scanning, centralized controls, and enhanced security training for development teams.
6 months ago
Kill Chain
Microsoft Teams Guest Access in 2025: Bypassing Defender Protections with Cross-Tenant Exploits
In late 2025, security researchers revealed a critical vulnerability in Microsoft Teams involving the platform's guest access feature. Attackers could exploit this cross-tenant blind spot by inviting victims to external Teams tenants, where Microsoft Defender for Office 365 protections set by the user’s home organization were bypassed. Instead, security controls depended on the external tenant’s environment, enabling malicious actors to deliver threats, such as phishing or malware, beyond the purview of corporate security policies. This weakness exposes organizations to significant business risk, allowing lateral phishing and potential data compromise through insufficient cloud policy enforcement. This incident underscores the ongoing risks inherent to cloud collaboration platforms where cross-tenant integrations are routine. The rapid adoption of hybrid work, increased SaaS reliance, and complex cloud permissions models are fueling new attack vectors that evade traditional endpoint and email security controls.
6 months ago
Kill Chain
Legacy Python Bootstrap Scripts Expose PyPI Supply Chain to Domain Takeover Risk
In June 2025, cybersecurity researchers at ReversingLabs uncovered a significant vulnerability in legacy Python packages distributed via PyPI. The weakness stems from outdated bootstrap scripts within the widely used zc.buildout automation tool, which reference external domains that have since become unregistered. This creates a supply chain attack risk: if an attacker registers one of these lapsed domains, they could host malicious code, which would be executed during package installation, compromising developer, CI/CD, or production environments. While there are no confirmed mass exploits yet, the affected ecosystem is large due to the extended usage of these packages. This incident is highly relevant as supply chain risks in open-source ecosystems continue to grow, and domain takeover remains a low-cost, high-impact attack vector. Increased attention to legacy codebases and dependency hygiene is essential as regulations tighten and attackers show rising interest in poisoning software development infrastructure.
6 months ago
Kill Chain
Gainsight-Salesforce 2025 Breach: A Wake-Up Call for SaaS Supply-Chain Security
In November 2025, Gainsight reported a security incident involving its SaaS applications integrated with Salesforce, after Salesforce observed suspicious API calls from non-allowlisted IP addresses linked to Gainsight services. This prompted Salesforce to revoke affected access tokens, limit integration capabilities, and initiate investigations, temporarily disrupting data flows for several customers and connected platforms such as Zendesk and HubSpot. Forensic analysis revealed threat activity tied to proxy/VPN infrastructure and IPs previously associated with the UNC6040 threat cluster, which had targeted Salesforce CRMs in past extortion campaigns, though no confirmed data exfiltration occurred. This incident exemplifies the persistent risk of supply-chain compromise through interconnected SaaS platforms, emphasizing how attackers can leverage trusted applications to pivot laterally and exploit enterprise data pipelines. With the steady rise in OAuth-based integrations and API dependency, businesses face mounting urgency to reevaluate third-party access, enforce zero-trust principles, and proactively monitor for anomalous behaviors within their SaaS ecosystems.
6 months ago
Kill Chain
OpenAI Mixpanel Breach: 2024 Supply-Chain Exposure of API Customer Data
In June 2024, OpenAI disclosed that a breach at its third-party analytics provider Mixpanel exposed limited identifying information of certain ChatGPT API customers. According to the company's notification, attackers compromised Mixpanel's systems and accessed data such as organization names and email addresses transmitted through Mixpanel's embedded analytics scripts. OpenAI clarified that payment or sensitive API data was not affected, and the incident did not impact all users. Prompt investigation and mitigation steps were initiated, including collaboration with Mixpanel and additional security controls around third-party integrations. This incident underscores the persistent risks associated with the digital supply chain. As organizations increasingly rely on external vendors for analytics and infrastructure, threat actors continue to exploit third-party weaknesses to obtain customer data—driving heightened attention from regulators and boards.
6 months ago
Kill Chain
Gainsight Expands Customer List After Salesforce Data Breach Investigation
In November 2025, Gainsight disclosed an expansion of its impacted customer list following suspicious activity targeting its cloud applications within the Salesforce platform. Originally affecting three customers identified incidentally by Salesforce, the scope broadened as investigation revealed further unauthorized access to sensitive business data. The breach, detected through abnormal activity monitoring, prompted Gainsight to alert clients and coordinate remediation steps while collaborating with Salesforce to identify the root cause. The company has not shared the exact number of affected customers but confirmed exposure to confidential customer information, presenting new compliance and reputational challenges. This incident reflects a continued surge in third-party and SaaS provider breaches, illustrating the interconnected risk facing organizations that rely on enterprise platforms. With attackers leveraging increasingly subtle lateral movement techniques and targeting east-west cloud traffic, robust zero trust controls and real-time anomaly detection are more critical than ever.
6 months ago
Kill Chain
Universal Jailbreaks: How Adversarial Poetry Unlocked AI Model Vulnerabilities in 2025
In late 2025, researchers uncovered a major vulnerability affecting leading AI providers, demonstrating that prompt injection using poetic phrasing can universally bypass safety alignment in large language models (LLMs). By translating malicious prompts into poetic verse and feeding them into 25 major proprietary and open-source LLMs, adversaries were able to achieve jailbreak attack success rates above 60% in many cases—far surpassing previous methods. This attack allowed models to generate outputs associated with high-risk domains, such as cyber-offense and weaponization, despite existing refusal mechanisms. The incident raises urgent concerns about the robustness of current model alignment and evaluation frameworks and exposes fundamental gaps in LLM safety design. This discovery is particularly significant as LLMs are now widely adopted across industries and critical sectors. The poetic technique's ability to systematically defeat existing safeguards highlights the evolving risks of adversarial prompt engineering and threatens AI-dependent workflows, regulatory compliance, and trust in intelligent automation.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports