✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
DriveSurge: Massive Website Compromise Leads to Widespread Malware Distribution
In June 2026, the DriveSurge operation was uncovered, revealing a sophisticated cybercriminal campaign that compromised thousands of legitimate websites to deliver malware through ClickFix and FakeUpdate attacks. Utilizing the zTDS traffic distribution system, attackers redirected unsuspecting visitors to malicious sites, leading to the installation of backdoors and other malware. This operation functioned as an initial access broker, selling system access to other threat actors for various malicious activities. The campaign targeted both Windows and macOS users and remained undetected for nearly a year, highlighting the evolving tactics of cybercriminals. The DriveSurge incident underscores the increasing complexity and scale of cyberattacks, emphasizing the need for organizations to enhance their cybersecurity measures. The use of trusted websites to distribute malware indicates a shift towards more deceptive and widespread attack vectors, making it imperative for businesses to implement robust security protocols and user education to mitigate such threats.
1 month ago
Kill Chain
VS Code Vulnerability Exposes GitHub OAuth Tokens to Attackers
In June 2026, a critical vulnerability was disclosed in Microsoft Visual Studio Code (VS Code) that allowed attackers to steal GitHub OAuth tokens through a single malicious link. Security researcher Ammar Askar demonstrated that by exploiting the webview implementation in VS Code, an attacker could execute malicious JavaScript to install a rogue extension, thereby capturing OAuth tokens with full read and write access to a user's repositories, including private ones. This vulnerability posed significant risks to developers, potentially exposing sensitive code and intellectual property. This incident underscores the growing threat of supply chain attacks targeting development environments. As developers increasingly rely on integrated tools and extensions, the security of these components becomes paramount. Organizations must remain vigilant, ensuring that their development tools are secure and up to date to prevent unauthorized access and data breaches.
1 month ago
Kill Chain
Microsoft Build 2026: Integrating Security Across the Development Lifecycle
At Microsoft Build 2026, held on June 2, 2026, Microsoft unveiled a comprehensive suite of security tools and capabilities aimed at integrating security throughout the development lifecycle. Key announcements included the introduction of the Microsoft Security multi-model agentic scanning harness (codename MDASH), designed to proactively identify and validate exploitable vulnerabilities in codebases, and the integration between Microsoft Defender and GitHub Code Security to prioritize and remediate code vulnerabilities efficiently. Additionally, Microsoft introduced the Agent 365 SDK to help developers build secure, enterprise-ready AI agents by default, and announced Defender AI model scanning to verify the integrity of AI models before deployment. These initiatives reflect Microsoft's commitment to embedding security into the development process, enabling faster and more secure innovation without compromising control. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/06/02/microsoft-build-2026-securing-code-agents-and-models-across-the-development-lifecycle/?utm_source=openai)) The relevance of these announcements is underscored by the increasing complexity and sophistication of cyber threats, particularly those leveraging AI to exploit vulnerabilities. By integrating advanced security measures directly into development tools and workflows, Microsoft aims to empower developers and security teams to stay ahead of emerging threats, ensuring that security is a foundational aspect of the development process rather than an afterthought.
1 month ago
Kill Chain
Trail of Bits Uncovers Critical Flaws in AI Skill Marketplaces
In June 2026, Trail of Bits published an analysis revealing significant vulnerabilities in public AI skill marketplaces, where malicious skills were found to steal credentials, exfiltrate data, and hijack agents. The study demonstrated that existing skill scanners, including those from ClawHub, Cisco, and skills.sh, were ineffective in detecting these threats. The researchers successfully bypassed these scanners using straightforward techniques, highlighting the inadequacy of current defenses against supply chain attacks in AI ecosystems. This incident underscores the urgent need for robust security measures in AI skill distribution channels. As AI agents become integral to various workflows, the proliferation of unvetted skills poses a substantial risk. Organizations must implement stringent governance frameworks, including version control, digital signing, zero-trust access, and centralized repositories, to mitigate these emerging threats.
1 month ago
Kill Chain
CISA Urges Immediate Action on Actively Exploited Oracle WebLogic Vulnerability CVE-2024-21182
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to address a high-severity vulnerability in Oracle WebLogic Server, identified as CVE-2024-21182. This flaw, patched in July 2024, allows unauthenticated attackers to exploit the T3 and IIOP protocols, potentially leading to unauthorized access to critical data. Despite the availability of patches, over 1,500 WebLogic servers remained exposed online, making them susceptible to exploitation. The resurgence of attacks targeting CVE-2024-21182 underscores the persistent threat posed by unpatched vulnerabilities. Organizations are urged to prioritize timely patch management to mitigate risks associated with known exploits, especially those that have been previously addressed but continue to be exploited due to delayed remediation efforts.
1 month ago
Kill Chain
Why the Browser is Now the Front Line for AI Security
In June 2026, a significant cybersecurity incident highlighted the browser as a critical frontline in AI security. Adversaries leveraged AI to rapidly develop and deploy sophisticated phishing kits, outpacing traditional defense mechanisms. Concurrently, employees' unregulated adoption of AI tools, including large language models (LLMs) and AI browser extensions, introduced vulnerabilities by exposing sensitive data and granting unauthorized access. This dual threat underscores the necessity for security platforms with deep visibility into browser sessions to effectively monitor and mitigate AI-driven risks. The incident underscores the evolving threat landscape where AI accelerates both attack capabilities and the proliferation of unvetted tools within organizations. As AI technologies become more integrated into daily operations, the urgency for comprehensive browser security solutions that can adapt to these rapid developments has never been greater.
1 month ago
Kill Chain
Google Addresses Actively Exploited Android Zero-Day CVE-2025-48595 in June 2026 Security Update
In June 2026, Google released security patches addressing 124 vulnerabilities in the Android operating system, notably including CVE-2025-48595. This high-severity zero-day flaw in the Android Framework allows local attackers to execute code and escalate privileges on devices running Android 14 and later. Exploitation does not require user interaction, suggesting potential use of malicious applications to gain unauthorized access. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/google-fixes-one-actively-exploited-android-zero-day-124-flaws/?utm_source=openai)) The active exploitation of CVE-2025-48595 underscores the persistent threat posed by zero-day vulnerabilities in widely used platforms. Organizations must prioritize timely application of security updates to mitigate risks associated with such flaws, especially given the increasing sophistication of targeted attacks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/google-fixes-one-actively-exploited-android-zero-day-124-flaws/?utm_source=openai))
1 month ago
Kill Chain
Critical Kirki Plugin Vulnerability (CVE-2026-8206) Exploited in WordPress Sites
In early June 2026, a critical privilege escalation vulnerability (CVE-2026-8206) was discovered in the Kirki WordPress plugin, affecting versions 6.0.0 through 6.0.6. This flaw allows unauthenticated attackers to reset passwords for any user account, including administrators, by exploiting the plugin's password reset function, which improperly handles email addresses. As a result, attackers can gain full control over affected websites, enabling them to install malicious plugins, alter content, and access sensitive data. The vulnerability was actively exploited, with over 222 attack attempts detected within a 24-hour period. A patch was released on May 18, 2026, in version 6.0.7, and users are strongly advised to update immediately to mitigate the risk. This incident underscores the ongoing risks associated with third-party plugins in widely used platforms like WordPress. It highlights the importance of prompt vulnerability management and the need for website administrators to stay vigilant about security updates to protect their sites from emerging threats.
1 month ago
Kill Chain
Oracle WebLogic CVE-2024-21182: Active Exploitation and Urgent Patch Advisory
In July 2024, Oracle addressed a high-severity vulnerability (CVE-2024-21182) in its WebLogic Server, which allowed unauthenticated attackers to gain unauthorized access via T3 and IIOP protocols, potentially compromising critical data. Despite the patch, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog in June 2026, indicating active exploitation in the wild. This development underscores the persistent threat posed by unpatched vulnerabilities in widely used enterprise software. Organizations relying on Oracle WebLogic Server must ensure they have applied the necessary patches to mitigate potential risks associated with this flaw.
1 month ago
Kill Chain
Google's June 2026 Android Security Update: Addressing 124 Vulnerabilities, Including Actively Exploited CVE-2025-48595
In June 2026, Google released security updates addressing 124 vulnerabilities in the Android operating system, notably including CVE-2025-48595—a high-severity privilege escalation flaw in the Framework component. This vulnerability affects Android versions 14 through 16 QPR2 and allows attackers to gain elevated privileges without user interaction, potentially leading to full device compromise. Google has acknowledged indications of limited, targeted exploitation of this flaw in the wild. The active exploitation of CVE-2025-48595 underscores the persistent threat posed by privilege escalation vulnerabilities in widely used mobile platforms. Organizations and individuals are urged to promptly apply the June 2026 security patches to mitigate potential risks associated with this and other addressed vulnerabilities.
1 month ago
Kill Chain
Dashlane Brute-Force Attack Highlights Need for Enhanced 2FA Security
In late May 2026, Dashlane, a prominent password management service, experienced a brute-force attack targeting its two-factor authentication (2FA) system. Attackers attempted to register new devices on user accounts by rapidly submitting numerous numeric combinations to bypass 2FA protections. This led to the temporary suspension of several user accounts as a security measure. While Dashlane's internal systems remained uncompromised, the attackers managed to download encrypted vaults from fewer than 20 personal plan users. These vaults, however, remain secure unless the attackers can decipher the users' master passwords. ([thehackernews.com](https://thehackernews.com/2026/06/dashlane-discloses-brute-force-attack.html?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats, particularly against authentication mechanisms. Organizations must continually assess and fortify their security protocols to mitigate such risks. The event also highlights the importance of user education on creating strong, unique master passwords to enhance the security of encrypted data.
1 month ago
Kill Chain
CISA Flags CVE-2024-21182: Immediate Action Required for Oracle WebLogic Server Users
In July 2024, Oracle disclosed CVE-2024-21182, a critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0. This flaw allows unauthenticated attackers with network access via T3 or IIOP protocols to gain unauthorized access to critical data. The vulnerability has a CVSS score of 7.5, indicating high severity. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2024-21182?utm_source=openai)) On June 1, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-21182 to its Known Exploited Vulnerabilities Catalog, confirming active exploitation in the wild. Organizations using affected versions are urged to apply vendor-provided patches immediately to mitigate potential risks. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2024-21182?utm_source=openai))
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports