✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Open VSX Registry's 2026 GlassWorm Supply Chain Attack: A Wake-Up Call for Extension Security
In January 2026, the Open VSX Registry, a vendor-neutral extension marketplace for Visual Studio Code, experienced a significant supply chain attack. Threat actors compromised a legitimate publisher's account to distribute malicious updates to four popular extensions, collectively downloaded over 22,000 times. These updates deployed the GlassWorm malware, specifically targeting macOS users by exfiltrating sensitive data such as browser cookies, cryptocurrency wallets, and developer credentials. The malware utilized sophisticated evasion techniques, including locale checks and blockchain-based command-and-control mechanisms, to avoid detection and dynamically manage its infrastructure. ([securityweek.com](https://www.securityweek.com/open-vsx-publisher-account-hijacked-in-fresh-glassworm-attack/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems, highlighting the critical need for robust security measures in extension marketplaces. In response, the Eclipse Foundation, which maintains the Open VSX Registry, has announced plans to implement pre-publication security checks to proactively identify and mitigate malicious extensions before they reach users. ([thehackernews.com](https://thehackernews.com/2026/02/eclipse-foundation-mandates-pre-publish.html?utm_source=openai))
4 months ago
Kill Chain
Apple Issues Urgent Update for 'DarkSword' Exploit in 2026
In March 2026, Apple issued urgent lock screen notifications to users of older iPhone and iPad models, warning them of active web-based exploits targeting outdated iOS versions. The 'DarkSword' exploit, which had been used by surveillance groups, became widely accessible after its code was leaked online, enabling attackers to exfiltrate sensitive data from devices running iOS versions 18.4 to 18.7. Apple responded by releasing security updates for iOS versions 15 through 26 and advised users on older systems to upgrade immediately to mitigate the risk. ([tomsguide.com](https://www.tomsguide.com/phones/iphones/darksword-exploit-just-went-global-millions-of-iphones-now-wide-open-to-hackers?utm_source=openai)) This incident underscores the critical importance of keeping devices updated to the latest software versions. The public availability of the 'DarkSword' exploit highlights the rapid dissemination of vulnerabilities and the necessity for users to remain vigilant against emerging threats. ([techradar.com](https://www.techradar.com/phones/update-your-iphone-now-apple-issues-a-rare-warning-to-ios-users-as-a-new-hacker-threat-is-discovered?utm_source=openai))
4 months ago
Kill Chain
TeamPCP's Malicious 'telnyx' PyPI Attack Exposes Supply Chain Vulnerabilities
In March 2026, the threat actor group TeamPCP executed a supply chain attack by uploading two malicious versions (4.87.1 and 4.87.2) of the 'telnyx' Python package to the Python Package Index (PyPI). These versions concealed credential-stealing malware within .WAV files, enabling the exfiltration of sensitive data from compromised systems. The attack underscores the vulnerability of open-source repositories to sophisticated supply chain compromises. This incident highlights the escalating trend of attackers targeting widely used open-source packages to distribute malware, emphasizing the need for enhanced vigilance and security measures in software supply chains.
4 months ago
Kill Chain
Coruna Exploit Kit: A Case Study in the Commercialization of Nation-State Cyber Tools
In February 2025, Google's Threat Intelligence Group (GTIG) identified 'Coruna,' a sophisticated iOS exploit kit comprising 23 vulnerabilities across five exploit chains, targeting devices running iOS 13 through 17.2.1. Initially deployed by a surveillance vendor for government clients, Coruna was later utilized by Russian state actors in espionage campaigns against Ukrainian users. By December 2025, the exploit kit had proliferated to financially motivated Chinese cybercriminals, who employed it to steal cryptocurrency from over 42,000 iOS devices via malicious websites. This rapid transition from state-sponsored espionage to widespread financial crime underscores the growing commercialization and accessibility of nation-state-level cyber tools. The Coruna incident highlights the urgent need for organizations to stay vigilant against advanced threats, as sophisticated exploit kits once exclusive to government entities are increasingly available to cybercriminals, posing significant risks to both individuals and enterprises.
4 months ago
Kill Chain
International Operation Dismantles LeakBase Cybercrime Forum in 2026
In early March 2026, an international law enforcement operation led by the FBI and Europol dismantled LeakBase, one of the world's largest cybercrime forums. Established in 2021, LeakBase had over 142,000 members and facilitated the trade of stolen data, including account credentials and financial information. The coordinated effort spanned 14 countries, resulting in the seizure of the forum's domains and databases, as well as multiple arrests and searches targeting the platform's most active users. This operation underscores the growing global collaboration in combating cybercrime and highlights the increasing focus on dismantling platforms that facilitate the sale of stolen data. The takedown of LeakBase serves as a significant deterrent to cybercriminals and emphasizes the importance of international cooperation in addressing the evolving cyber threat landscape.
4 months ago
Kill Chain
Critical Langflow RCE Vulnerability (CVE-2026-33017) Exploited in the Wild
In March 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-33017, was discovered in Langflow, an open-source framework for building AI workflows. This flaw allows unauthenticated attackers to execute arbitrary Python code on affected servers by sending crafted HTTP requests to the unsandboxed flow execution endpoint. The vulnerability affects Langflow versions 1.8.1 and earlier, potentially leading to full system compromise, data theft, and unauthorized access to sensitive information. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27966/?utm_source=openai)) The rapid exploitation of this vulnerability underscores the increasing targeting of AI development tools by threat actors. Organizations utilizing Langflow are urged to upgrade to version 1.9.0 or later, which addresses this security issue. Additionally, it is recommended to disable or restrict access to the vulnerable endpoint, monitor for suspicious activity, and rotate API keys and credentials to mitigate potential risks. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27966/?utm_source=openai))
4 months ago
Kill Chain
Coruna Exploit Kit: A Cautionary Tale of Advanced Hacking Tools in Cybercriminal Hands
In 2025, the Coruna exploit kit emerged as a sophisticated tool targeting iPhones running iOS versions 13.0 through 17.2.1. Initially deployed by a surveillance vendor for government clients, Coruna was later utilized by Russian espionage groups in attacks against Ukrainian users and by financially motivated hackers in China. The kit comprises five exploit chains and 23 vulnerabilities, including CVE-2023-32434 and CVE-2023-38606, previously exploited in Operation Triangulation. These vulnerabilities enable remote code execution and privilege escalation, granting attackers full control over affected devices. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai)) The proliferation of Coruna underscores the risks associated with the leakage of government-grade hacking tools into the broader cybercriminal ecosystem. This incident highlights the urgent need for organizations to implement robust security measures, promptly apply software updates, and monitor for emerging threats to protect sensitive data and maintain operational integrity. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai))
4 months ago
Kill Chain
Understanding the Coruna iOS Exploit Kit: A 2026 Security Threat
In early 2026, the Coruna iOS exploit kit emerged as a significant threat, targeting iPhones running iOS versions 13.0 through 17.2.1. This sophisticated toolkit comprises 23 exploits, including zero-day vulnerabilities, enabling attackers to execute zero-click attacks via iMessage. Initially developed for government surveillance, Coruna has since been adopted by cybercriminal groups, leading to widespread data breaches and financial losses. The kit's capabilities allow for full device compromise, granting unauthorized access to sensitive information and enabling remote control of infected devices. The proliferation of Coruna underscores the evolving landscape of mobile threats and the critical need for robust security measures to protect against advanced exploit kits. Organizations and individuals must prioritize timely software updates, implement comprehensive security protocols, and remain vigilant against emerging threats to safeguard their digital assets.
4 months ago
Kill Chain
Critical Vulnerability in Anthropic's Claude Chrome Extension Highlights AI Security Risks
In March 2026, a critical vulnerability was discovered in Anthropic's Claude Chrome Extension, allowing malicious actors to inject prompts into the assistant without user interaction. This zero-click cross-site scripting (XSS) flaw enabled attackers to execute arbitrary commands by embedding malicious code into web pages, leading to potential data exfiltration and unauthorized actions. The vulnerability was promptly addressed by Anthropic through an emergency patch, mitigating the risk to users. This incident underscores the growing threat landscape associated with AI-powered browser extensions. As these tools become more integrated into daily workflows, they present new vectors for exploitation. Organizations must remain vigilant, ensuring that such extensions are regularly updated and monitored for security vulnerabilities to prevent similar attacks.
4 months ago
Kill Chain
Unveiling the Scarlet Goldfinch 2025 ClickFix Malware Campaign
In 2025, the Scarlet Goldfinch threat actor launched a sophisticated malware campaign utilizing the ClickFix social engineering technique. This method deceived users into executing malicious commands under the guise of routine system verifications, leading to the installation of NetSupport Manager, a remote access tool. The campaign primarily targeted Windows systems, exploiting compromised websites to display fake browser update prompts, which, when acted upon, initiated the malware download and execution process. ([redcanary.com](https://redcanary.com/threat-detection-report/threats/scarlet-goldfinch/?utm_source=openai)) The significance of this incident lies in the evolution of social engineering tactics, highlighting the increasing sophistication of threat actors in bypassing traditional security measures. The widespread use of ClickFix underscores the necessity for enhanced user education and the implementation of robust security protocols to mitigate such deceptive attack vectors.
4 months ago
Kill Chain
OpenCode Systems 2026 Access Control Vulnerability Exposes SMS Messages
In March 2026, a significant security vulnerability (CVE-2025-70614) was identified in OpenCode Systems' OC Messaging and USSD Gateway version 6.32.2. This flaw allowed authenticated users with low privileges to access SMS messages beyond their authorized scope by manipulating company or tenant identifier parameters. The vulnerability posed a substantial risk to data confidentiality across multi-tenant environments. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2025-70614/?utm_source=openai)) The incident underscores the critical importance of robust access control mechanisms in multi-tenant systems. Organizations are urged to review and strengthen their access control policies to prevent similar vulnerabilities and protect sensitive information.
4 months ago
Kill Chain
Apple's March 2026 Security Update: Essential Patches for Device Protection
In March 2026, Apple released a comprehensive security update addressing 85 vulnerabilities across its operating systems, including iOS, iPadOS, macOS, tvOS, watchOS, and visionOS. Notably, CVE-2025-43376 allowed remote attackers to view leaked DNS queries with Private Relay enabled, and CVE-2025-43534 permitted physical attackers to bypass Activation Lock on iOS devices. These vulnerabilities, among others, were patched to enhance system security and protect user data. This update underscores the critical importance of timely software updates, as unpatched vulnerabilities can be exploited by attackers to compromise devices and access sensitive information. Organizations and individuals are urged to apply these patches promptly to mitigate potential risks.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports