✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
EvilTokens Phishing Campaign: A New Threat to Microsoft 365 Security
In February 2026, the phishing-as-a-service platform EvilTokens emerged, compromising over 340 Microsoft 365 organizations across five countries within five weeks. The attack exploited the OAuth device code authentication flow, tricking users into entering a short code at microsoft.com/devicelogin and completing their MFA challenge. Unbeknownst to them, this granted attackers valid refresh tokens with access to emails, files, calendars, and contacts, all without stealing passwords or bypassing MFA. This method effectively bypassed traditional identity defenses, as the OAuth consent screen has become an instinctive click for many users. ([thehackernews.com](https://thehackernews.com/2026/05/the-new-phishing-click-how-oauth.html?utm_source=openai)) The incident underscores a significant shift in phishing tactics, highlighting the exploitation of legitimate authentication processes to gain unauthorized access. As attackers increasingly leverage such methods, organizations must reassess their security protocols to address these evolving threats.
2 months ago
Kill Chain
TeamPCP's Compromise of Checkmarx Jenkins Plugin: A 2026 Supply Chain Attack
In May 2026, the threat group TeamPCP compromised Checkmarx's Jenkins AST plugin by publishing a backdoored version (2026.5.09) to the Jenkins Marketplace. This malicious plugin, assigned CVE-2026-33634 with a CVSS score of 9.4, allowed attackers to execute code within CI/CD pipelines, potentially exposing sensitive credentials and source code. The incident follows previous attacks by TeamPCP on Checkmarx's KICS tool and the Trivy vulnerability scanner, indicating a targeted campaign against developer tools. ([thehackernews.com](https://thehackernews.com/2026/05/teampcp-compromises-checkmarx-jenkins.html?utm_source=openai)) This breach underscores the escalating threat of supply chain attacks targeting CI/CD environments. Organizations must enhance their security measures by verifying the integrity of third-party plugins and implementing robust monitoring to detect unauthorized changes within their development pipelines.
2 months ago
Kill Chain
Microsoft Disrupts Fox Tempest's Malware-Signing Service Operation
In May 2026, Microsoft disrupted Fox Tempest, a financially motivated threat actor operating a malware-signing-as-a-service (MSaaS) platform. Fox Tempest exploited Microsoft's Artifact Signing to generate over a thousand fraudulent code-signing certificates, enabling other cybercriminals to distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, under the guise of legitimate software. This operation facilitated attacks across various sectors globally, including healthcare, education, government, and financial services. The takedown involved revoking the fraudulent certificates and dismantling the infrastructure supporting Fox Tempest's operations. The incident underscores the evolving tactics of cybercriminals who abuse legitimate services to enhance the credibility of their malware, thereby evading traditional security measures. It highlights the critical need for organizations to implement robust security controls, including advanced threat detection and response capabilities, to mitigate the risks posed by such sophisticated attack vectors.
2 months ago
Kill Chain
Microsoft's 2026 Takedown of Fox Tempest: A Major Blow to Cybercrime
In May 2026, Microsoft, through its Digital Crimes Unit, successfully dismantled the infrastructure of Fox Tempest, a cybercrime service that produced and sold over 1,000 fraudulent code-signing certificates. These certificates were utilized by various ransomware groups, including Rhysida and Vanilla Tempest, to make malicious software appear legitimate, thereby bypassing security defenses. The operation involved seizing domain names, websites, and Azure resources linked to Fox Tempest, effectively disrupting their malware-signing-as-a-service operations. ([axios.com](https://www.axios.com/2026/05/19/microsoft-fox-tempest-law-enforcement-takedown?utm_source=openai)) This incident underscores a significant shift in cybercriminal tactics, moving upstream to exploit software verification systems. The ability to fabricate trusted certificates at scale poses a substantial threat to global cybersecurity, emphasizing the need for enhanced vigilance and robust verification processes within software supply chains.
2 months ago
Kill Chain
Pwn2Own Berlin 2026: Unveiling 47 Zero-Day Vulnerabilities
The Pwn2Own Berlin 2026 hacking contest, held from May 14 to May 16, 2026, at the OffensiveCon conference, concluded with security researchers earning $1,298,250 in rewards after successfully exploiting 47 zero-day vulnerabilities. The competition focused on enterprise technologies and artificial intelligence, targeting fully patched products across various categories, including web browsers, enterprise applications, servers, and virtualization platforms. Notably, the DEVCORE Research Team secured the highest reward of $200,000 by chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange. This event underscores the persistent challenges in securing enterprise software and the critical importance of proactive vulnerability management. The exposure of these zero-day vulnerabilities highlights the need for organizations to stay vigilant and prioritize timely patching to mitigate potential exploitation risks.
2 months ago
Kill Chain
Clop Ransomware Targets Cloud Clearway Group in March 2026 Attack
In March 2026, the Clop ransomware group executed a cyberattack on Cloud Clearway Group, a leading IT services firm in Canada. The attackers encrypted sensitive data and threatened to release it unless their ransom demands were met. This incident underscores the persistent threat posed by Clop, which has been responsible for numerous high-profile attacks targeting various sectors globally. The attack on Cloud Clearway Group highlights the evolving tactics of ransomware groups, emphasizing the need for organizations to bolster their cybersecurity defenses. With ransomware attacks becoming more sophisticated and frequent, businesses must prioritize proactive measures to mitigate potential risks and ensure data security.
2 months ago
Kill Chain
Malicious npm Packages Deliver Infostealers and DDoS Malware
In May 2026, cybersecurity researchers identified four malicious npm packages—chalk-tempalte, @deadcode09284814/axios-util, axois-utils, and color-style-utils—containing infostealer malware and DDoS botnet functionality. These packages, published by the user deadcode09284814, were designed to steal sensitive information and facilitate distributed denial-of-service attacks. Notably, one package was a clone of the Shai-Hulud worm, previously leaked by TeamPCP. This incident underscores the escalating threat of supply chain attacks targeting developers through trusted repositories like npm. The discovery highlights the critical need for developers to exercise caution when integrating third-party packages, as attackers increasingly exploit public repositories to distribute malware. Implementing robust security measures, such as verifying package authenticity and monitoring for suspicious activity, is essential to mitigate the risks associated with supply chain compromises.
2 months ago
Kill Chain
MiniPlasma Zero-Day: A Critical Threat to Windows 11 Security
In May 2026, security researcher Chaotic Eclipse disclosed a critical zero-day vulnerability in Microsoft Windows, codenamed MiniPlasma. This flaw affects the Windows Cloud Files Mini Filter Driver (cldflt.sys) and allows attackers to escalate privileges to SYSTEM level on fully patched Windows 11 systems. The vulnerability was initially reported to Microsoft in September 2020 and was believed to have been patched in December 2020 as CVE-2020-17103. However, recent findings indicate that the issue remains unpatched, posing significant security risks. The public release of the MiniPlasma exploit underscores ongoing challenges in Windows security, particularly concerning privilege escalation vulnerabilities. Organizations must reassess their security postures and implement additional measures to mitigate the risks associated with this unpatched flaw.
2 months ago
Kill Chain
Critical Vulnerability in Ivanti Xtraction (CVE-2026-8043) Poses Severe Risks
In May 2026, Ivanti disclosed a critical vulnerability (CVE-2026-8043) in its Xtraction platform, which allows authenticated remote attackers to bypass directory restrictions. This flaw enables unauthorized access to sensitive internal system files and permits writing arbitrary HTML files to web directories, potentially transforming trusted servers into malicious hosts for client-side attacks. The vulnerability carries a CVSS score of 9.6, indicating its severity. The healthcare sector is particularly at risk due to the sensitive nature of Protected Health Information (PHI) managed by Xtraction. Organizations are urged to upgrade to version 2026.2 immediately to mitigate potential data exposure and client-side attacks.
2 months ago
Kill Chain
Critical Cybersecurity Incidents: Exchange 0-Day, npm Worm, and Cisco Exploit
In May 2026, a series of significant cybersecurity incidents underscored the vulnerabilities in widely used systems and software. A zero-day vulnerability (CVE-2026-42897) in Microsoft Exchange Server was actively exploited, allowing attackers to execute arbitrary JavaScript via crafted emails, affecting on-premises deployments. Concurrently, the 'Mini Shai-Hulud' campaign compromised multiple npm packages, including those from TanStack and Mistral AI, embedding malicious code to steal credentials and potentially execute destructive actions. Additionally, a critical authentication bypass flaw (CVE-2026-20182) in Cisco Catalyst SD-WAN Controllers was exploited by threat actor UAT-8616 to gain unauthorized access and escalate privileges. These incidents highlight the escalating sophistication of supply chain attacks and the critical need for robust security measures across all software dependencies. Organizations must prioritize patching known vulnerabilities, implement stringent access controls, and continuously monitor for anomalous activities to mitigate the risks posed by such multifaceted threats.
2 months ago
Kill Chain
Mini Shai-Hulud Attack: A Wake-Up Call for Developer Ecosystem Security
Between April 29 and May 1, 2026, a coordinated supply chain attack known as "Mini Shai-Hulud" targeted multiple developer ecosystems, including npm, PyPI, and Docker Hub. The threat actor group TeamPCP injected malicious code into widely used packages such as SAP's Cloud Application Programming Model, PyTorch Lightning, and Intercom's npm package. This malware harvested sensitive credentials from developer environments and CI/CD pipelines, including GitHub tokens, cloud API keys, and SSH keys, by exfiltrating them to attacker-controlled repositories. The attack compromised over 170 packages, affecting millions of developers and organizations worldwide. ([labs.cloudsecurityalliance.org](https://labs.cloudsecurityalliance.org/research/csa-research-note-mini-shai-hulud-supply-chain-20260503-csa/?utm_source=openai)) This incident underscores the evolving nature of supply chain attacks, which now focus on developer workstations as entry points. The integration of malicious code into trusted packages highlights the need for enhanced security measures in the software development lifecycle, particularly in dependency management and CI/CD processes. Organizations must adopt comprehensive strategies to protect against such sophisticated threats.
2 months ago
Kill Chain
YellowKey Exploit: A Critical Threat to BitLocker Encryption on Windows 11
In May 2026, a security researcher known as Nightmare-Eclipse disclosed a critical vulnerability named YellowKey, which allows attackers with physical access to bypass BitLocker encryption on Windows 11 systems. By exploiting the Windows Recovery Environment (WinRE), an attacker can use a specially crafted USB stick to gain full access to encrypted drives without requiring the user's password. This vulnerability affects default deployments of BitLocker, posing significant risks to data security. The disclosure of YellowKey underscores the ongoing challenges in securing physical access points and highlights the need for robust encryption practices. Organizations relying on BitLocker for data protection must reassess their security measures to mitigate potential exploitation of this vulnerability.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports