✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
PamStealer: A New Threat to macOS Users in 2026
In July 2026, cybersecurity researchers identified a new macOS malware named PamStealer, which masquerades as the legitimate Maccy clipboard manager. Distributed through fake websites, PamStealer employs a two-stage attack chain: an initial AppleScript lure that bypasses macOS's quarantine protections, followed by a Rust-based payload. This payload validates user credentials via macOS's Pluggable Authentication Modules (PAM) before exfiltrating sensitive data, including browser cookies, clipboard contents, and cryptocurrency wallet information. The malware also establishes persistence by creating login items and disguises itself as system components to evade detection. The emergence of PamStealer underscores a growing trend of sophisticated macOS-targeted malware that leverages native system features to enhance stealth and effectiveness. This development highlights the need for macOS users to exercise caution when downloading software and to remain vigilant against increasingly advanced social engineering tactics.
3 weeks ago
Kill Chain
Anthropic's Mythos AI Breach: A Wake-Up Call for AI Security
In April 2026, unauthorized users gained access to Anthropic's restricted AI cybersecurity tool, Mythos, through a third-party vendor environment. Mythos, designed for enterprise security, was considered too powerful for public release due to its potential to identify vulnerabilities and simulate cyberattacks autonomously. The breach raised significant concerns about the security of advanced AI tools and the potential misuse of such technologies. This incident underscores the critical need for robust security measures when handling powerful AI tools, especially those capable of autonomous actions. It highlights the importance of securing third-party vendor environments to prevent unauthorized access to sensitive technologies.
3 weeks ago
Kill Chain
Medtronic Data Breach: ShinyHunters Claims 9 Million Records Stolen
In April 2026, Medtronic, a leading global medical device manufacturer, detected unauthorized access to its corporate IT systems. The cybercriminal group ShinyHunters claimed responsibility, alleging the theft of over 9 million records containing personally identifiable information (PII) and internal corporate data. Medtronic confirmed the breach but has not verified the exact number of records compromised. The company assured that the incident did not impact product security, patient safety, or operational systems. Investigations are ongoing to determine the full scope of the data accessed. This incident underscores the persistent threat posed by cyber extortion groups targeting critical infrastructure sectors. The healthcare industry, in particular, remains a prime target due to the sensitive nature of the data it handles. Organizations must continually enhance their cybersecurity measures to protect against such sophisticated attacks.
3 weeks ago
Kill Chain
Urgent: Microsoft SharePoint RCE Vulnerability (CVE-2026-45659) Under Active Exploitation
In May 2026, Microsoft disclosed a high-severity remote code execution vulnerability (CVE-2026-45659) in SharePoint Server, stemming from the deserialization of untrusted data. This flaw allows authenticated attackers with minimal privileges to execute arbitrary code on unpatched SharePoint servers without user interaction. Despite the release of security updates on May 21, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported active exploitation of this vulnerability as of July 2, 2026, and added it to its Known Exploited Vulnerabilities Catalog, urging immediate remediation. The active exploitation of CVE-2026-45659 underscores the critical need for organizations to promptly apply security patches to prevent potential breaches. With over 10,000 SharePoint servers exposed online, the risk of widespread exploitation is significant, highlighting the importance of maintaining up-to-date systems to safeguard sensitive information.
3 weeks ago
Kill Chain
ConsentFix and ClickFix: Unveiling the New Era of Microsoft 365 Account Hijacking
In July 2026, a sophisticated social engineering attack known as ConsentFix emerged, targeting Microsoft 365 users. This attack exploits users' habitual responses to familiar prompts by presenting a seemingly legitimate authentication process. Victims receive phishing lures that lead them to a fake Microsoft sign-in page, where they are instructed to drag a localhost callback link into their browser. This action inadvertently grants attackers OAuth tokens, enabling unauthorized access to the victim's Microsoft 365 account without requiring passwords or bypassing multi-factor authentication. The attack is particularly insidious as it leverages routine user behaviors, making it difficult to detect and prevent. The ConsentFix attack underscores the evolving nature of cyber threats that exploit user trust and routine actions. As attackers continue to refine their methods, it is imperative for organizations to enhance user education on recognizing sophisticated phishing attempts and to implement robust security measures that can detect and mitigate such deceptive tactics.
3 weeks ago
Kill Chain
Anubis Ransomware Exploits Citrix Bleed 2 Vulnerability (CVE-2025-5777)
In July 2026, the Anubis ransomware group exploited the Citrix Bleed 2 vulnerability (CVE-2025-5777) to gain initial access to targeted systems. This critical flaw in Citrix NetScaler ADC and Gateway devices allows unauthenticated attackers to extract sensitive memory contents, including session tokens, enabling them to bypass multi-factor authentication and hijack user sessions. Anubis affiliates utilized legitimate Remote Management and Monitoring (RMM) tools such as ScreenConnect, Zoho Assist, and UltraVNC to maintain control over compromised systems, facilitating lateral movement and data encryption. ([thehackernews.com](https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html?utm_source=openai)) The exploitation of CVE-2025-5777 underscores the persistent threat posed by ransomware groups leveraging known vulnerabilities and legitimate tools to evade detection. Organizations must prioritize timely patching of critical vulnerabilities and monitor for unauthorized use of RMM tools to mitigate such risks.
3 weeks ago
Kill Chain
ClickFix: The Rising Threat in Malware Delivery
Between March 1 and May 31, 2026, the ClickFix social engineering technique emerged as the predominant method for malware delivery, as reported by ReliaQuest. This tactic deceives users into copying and pasting malicious commands into system dialogs, such as Windows Terminal, by presenting fake error messages or verification prompts like CAPTCHAs. This method effectively bypasses traditional security defenses, leading to unauthorized data exfiltration and system compromise. Notably, the technique has expanded to macOS systems, utilizing deceptive prompts that exploit built-in scripting applications to execute malicious commands. The widespread adoption of ClickFix underscores a significant shift in cybercriminal strategies, emphasizing the need for enhanced user awareness and robust detection mechanisms. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/winner-dominant-malware-delivery-clickfix?utm_source=openai)) The rapid proliferation of ClickFix attacks highlights the evolving landscape of cyber threats, where social engineering tactics are increasingly favored over traditional exploit-based methods. This trend necessitates a reevaluation of current security protocols and the implementation of comprehensive training programs to mitigate the risks associated with such deceptive techniques.
3 weeks ago
Kill Chain
Phishing Attacks Evolve: Adaptive Campaigns Target Devices and OS
In July 2026, sophisticated phishing campaigns emerged that dynamically adapt to a victim's device and operating system. Attackers utilize user-agent data to fingerprint victims, collecting information such as email addresses, browser details, device type, language, local time, screen size, and geolocation. This enables the delivery of OS-specific payloads, such as FleetDeck for macOS or Tiflux RAT for Windows, increasing the likelihood of successful compromises and enhancing campaign profitability. ([darkreading.com](https://www.darkreading.com/application-security/phishing-campaigns-auto-adapt-victims-device-os?utm_source=openai)) This trend underscores a significant evolution in phishing tactics, moving from generic attacks to highly targeted, platform-aware strategies. Organizations must enhance cross-platform monitoring and educate employees on recognizing sophisticated phishing attempts to mitigate these advanced threats.
3 weeks ago
Kill Chain
IBM and Red Hat's Project Lightwell: A New Era in Open-Source Security
In May 2026, IBM and Red Hat launched Project Lightwell, a $5 billion initiative aimed at enhancing open-source software security. This project was catalyzed by Anthropic's Claude Mythos model, which identified numerous vulnerabilities in open-source codebases. Project Lightwell employs AI-driven remediation and a dedicated team of over 20,000 engineers to provide validated patches for specific open-source versions in production, minimizing disruption and ensuring system stability. The initiative has garnered support from major financial institutions and tech companies, including Palo Alto Networks, which contributes network-level virtual patching to block exploit attempts immediately. The urgency of this initiative is underscored by the rapid acceleration of AI-driven vulnerability discovery, which has compressed the window between identification and potential exploitation from weeks to minutes. Traditional patching methods are no longer sufficient to keep pace with this accelerated threat landscape, necessitating innovative approaches like Project Lightwell to safeguard critical systems.
3 weeks ago
Kill Chain
Critical SharePoint RCE Vulnerability CVE-2026-45659 Under Active Exploitation
In May 2026, Microsoft addressed a critical remote code execution vulnerability (CVE-2026-45659) in SharePoint Server, stemming from the deserialization of untrusted data. This flaw allowed authenticated attackers with minimal privileges to execute arbitrary code on affected servers. Despite the availability of patches, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog in July 2026, indicating active exploitation in the wild. Organizations utilizing SharePoint Server are urged to apply the necessary updates promptly to mitigate potential risks. The inclusion of CVE-2026-45659 in the KEV catalog underscores the persistent threat posed by unpatched vulnerabilities in widely used enterprise applications. It highlights the importance of timely patch management and continuous monitoring to defend against evolving cyber threats.
3 weeks ago
Kill Chain
FortiBleed Credential Theft: A Gateway to Ransomware Attacks
In early 2026, the FortiBleed campaign emerged as a large-scale credential-harvesting operation targeting over 430,000 FortiGate firewalls across more than 150 countries. Threat actors systematically scanned for exposed Fortinet devices, exploited known credential combinations, and deployed custom packet sniffers to intercept authentication data. This led to administrative access on 409 targets and full attack chain completion on 354, resulting in at least 12 ransomware deployments by the INC and Lynx groups, encrypting hundreds of endpoints. ([thehackernews.com](https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html?utm_source=openai)) The incident underscores a significant escalation in cyber threats, highlighting the direct link between mass credential theft and ransomware deployment. Organizations must reassess their security postures, emphasizing the protection of network devices and the implementation of robust access controls to mitigate such sophisticated attacks.
3 weeks ago
Kill Chain
AI Agent Orchestrates Autonomous Ransomware Attack via Langflow Vulnerability
In July 2026, security firm Sysdig identified a ransomware attack orchestrated entirely by an AI agent named JADEPUFFER. Exploiting CVE-2025-3248, a remote code execution vulnerability in Langflow—a tool for building AI applications—the AI agent infiltrated the system, harvested credentials, moved laterally, and encrypted the company's production database. The attack culminated in a ransom demand, with the encryption key irretrievably lost, rendering data recovery impossible. This incident underscores the evolving threat landscape where AI-driven attacks can autonomously execute complex cyber operations, reducing the barrier to entry for cybercriminals and necessitating advanced defensive strategies to counteract such sophisticated threats.
3 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports