Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
NexShield Fake Ad Blocker & CrashFix: 2026's Browser Extension Malware
In January 2026, a sophisticated malvertising campaign leveraged a fake Chrome and Edge extension named NexShield to target corporate environments. Purported as a privacy-focused ad blocker, NexShield was distributed through the Chrome Web Store and social engineering tactics. Upon installation, the extension intentionally crashed browsers and subsequently displayed fake warnings instructing users to run malicious commands in Windows Command Prompt, thereby installing ModeloRAT—a Python-based remote access tool with extensive reconnaissance and persistence capabilities. The campaign, dubbed 'CrashFix' and attributed to threat actor KongTuke, demonstrated advanced evasion techniques, delayed payload execution, and targeted both corporate and individual users. This incident exemplifies the growing threat from malicious browser extensions and evolving malvertising techniques. Security experts note a marked increase in targeted, multi-stage attacks that exploit trusted distribution channels and leverage social engineering to compromise endpoints, underlining the urgent need for robust browser extension controls and ongoing user awareness.
8 months ago
Kill Chain
StackWarp: AMD’s Hardware Flaw Exposes Confidential Cloud VMs to Attack
In January 2026, researchers disclosed a vulnerability called StackWarp, affecting AMD’s Zen 1 through Zen 5 processor lines, including EPYC models widely used in cloud and enterprise environments. The flaw (CVE-2025-29943) enables privileged threat actors on host servers to manipulate the stack pointer of guest memory in confidential virtual machines (CVMs) secured with AMD SEV-SNP. By exploiting a previously undocumented control bit, attackers can redirect program flow inside targeted VMs, leading to remote code execution, privilege escalation, and exposure of sensitive assets such as cryptographic keys or kernel privileges. AMD published mitigations and microcode updates in July and October 2025, with additional firmware patches pending. This incident is a compelling example of the persistent risks stemming from microarchitectural attacks bypassing virtualization and memory encryption boundaries. As supply chain, multi-tenant cloud, and confidential computing adoption increases, organizations should regularly assess hardware-layer exposures and stay current on firmware updates to limit high-impact cascades.
8 months ago
Kill Chain
CrashFix Chrome Extension Attack Delivers ModeloRAT in ClickFix-Style Campaign
In January 2026, security researchers uncovered the 'KongTuke' campaign, which weaponized a malicious Chrome extension named CrashFix, disguised as an ad blocker. Attackers exploited a faux browser crash workflow—imitating ClickFix lures—to trick victims into running malicious commands, delivering the new ModeloRAT remote access trojan (RAT). The campaign allowed threat actors to silently gain persistent, covert access, facilitating lateral movement and potential data exfiltration within corporate environments. The incident highlights the evolving sophistication of browser-based attack chains and underscores browser extension risk as a modern threat vector for organizations reliant on SaaS and web apps. This breach is emblematic of a surge in malicious browser extensions delivering advanced malware. It showcases a growing trend toward supply chain compromise and the abuse of user trust in widely used browser platforms, calling for improved extension vetting and proactive security controls.
8 months ago
Kill Chain
How an XSS Bug in StealC Malware Panel Unmasked Threat Actors in 2026
In January 2026, cybersecurity researchers exploited a cross-site scripting (XSS) vulnerability in the StealC information stealer's web-based control panel. By leveraging this flaw, they monitored active threat actor sessions, collected system fingerprints, and obtained critical intelligence on StealC's illicit operations. The StealC malware, known for targeting credentials and sensitive data from infected endpoints, was actively managed via this compromised control panel by cybercriminal operators. As a result of this research, defenders gained unprecedented visibility into threat actor workflow and TTPs, turning a malicious tool’s own infrastructure against its controllers. This incident highlights the growing focus on attacking the infrastructure of threat actors themselves, signifying a shift in defensive strategies. Vulnerabilities within criminal tooling and panels can be weaponized by blue teams to gain actionable threat intelligence, reflecting broader trends in intrusion analysis and adversary disruption.
8 months ago
Kill Chain
Fortinet 2026: How RedLine Clipjack and Copilot Shaped a New Breed of Multi-Vector Attacks
In early 2026, multiple organizations suffered a multi-vector cyberattack campaign leveraging Fortinet device vulnerabilities, RedLine stealer variants with clipjack capabilities, and weaponized Copilot-integrated phishing. Threat actors gained initial access through unpatched Fortinet appliances, moved laterally via east-west traffic, and deployed RedLine malware to intercept credentials and exfiltrate sensitive data. The attackers further abused cloud AI tools to automate reconnaissance and launch targeted campaigns, leading to significant data compromise and operational disruption across cloud and hybrid environments. This incident underscores an accelerating trend: attackers are combining zero-day exploits, infostealers, and AI-driven automation to bypass traditional defenses. As threat actors become more agile and creative with emerging tools, organizations face growing pressure to secure east-west flows and implement real-time anomaly detection to mitigate multi-stage breaches.
8 months ago
Kill Chain
Fortinet FortiSIEM CVE-2025-64155: Critical Vulnerability Exploited in the Wild
In June 2025, Fortinet disclosed CVE-2025-64155, a critical command injection vulnerability affecting FortiSIEM, its security information and event management solution. Attackers began exploiting the flaw almost immediately after disclosure, leveraging it to execute unauthorized system commands and gain persistent access across multiple targeted networks. Malicious activity was detected from a diverse array of IP addresses, suggesting widespread probing and potential compromise. The rapid weaponization of the vulnerability placed organizations relying on FortiSIEM at risk of data exfiltration, lateral movement, and potential service disruption, underscoring the importance of timely patch management and layered defenses. This incident is emblematic of a growing trend where attackers aggressively target newly disclosed vulnerabilities in widely used security platforms. The event highlights the urgent need for rapid vulnerability response processes and reevaluation of vendor risk in security-critical infrastructure, as threat actors continue to automate exploitation of critical flaws in security tooling itself.
8 months ago
Kill Chain
Inside the 2024 Payroll Social Engineering Breach: Lessons from the Payroll Pirates
In early 2024, a major payroll provider experienced a sophisticated social engineering breach orchestrated by attackers dubbed the 'Payroll Pirates.' The threat actors engineered convincing phishing campaigns targeting payroll staff, tricking them into divulging critical credentials. Once initial access was secured, the attackers leveraged lateral movement techniques to escalate privileges and manipulate internal payroll processes, ultimately leading to fraudulent fund transfers and sensitive data exposure. Rapid detection efforts limited further impact, but the breach resulted in financial losses, operational disruption, and increased scrutiny over internal controls. This incident underscores the resurgence of highly targeted social engineering attacks, specifically in the payroll and finance sectors. As attackers blend human manipulation with advanced technical tactics, organizations must prioritize zero trust architectures, staff awareness, and continuous threat monitoring to defend against this evolving risk landscape.
8 months ago
Kill Chain
Google Pixel 9's 2025 Zero-Click Exploit Chain: Lessons in Mobile Supply Chain Security
In 2025, security researchers demonstrated a critical 0-click exploit chain targeting Google Pixel 9 and other Android devices, leveraging vulnerabilities in the Dolby UDC audio codec and the BigWave driver. Attackers could remotely execute code without user interaction by exploiting flaws in audio file processing and privilege escalation within device drivers. Despite early reporting and clear exploitability, it took vendors up to 139 days to release patches, leaving millions of Android users at risk. Gaps in patch management, inconsistent security controls, and delayed vulnerability classification contributed to prolonged exposure and a significant operational risk. This incident underscores the urgency of promptly addressing zero-click vulnerabilities and supply chain security issues in mobile ecosystems. As attackers increasingly exploit overlooked decoders, device drivers, and rapidly introduced AI features, coordinated patching and proactive privilege reduction remain essential to counter evolving mobile threats.
8 months ago
Kill Chain
Fortinet FortiSIEM Zero-Day: Exploitation Surge Exposes SIEM Risks in 2024
In June 2024, attackers began actively exploiting a critical vulnerability (CVE-2024-XXXX) in Fortinet FortiSIEM, a widely deployed security event management solution. The flaw, which allows remote code execution via specially crafted API requests, was leveraged soon after public proof-of-concept exploit code emerged. Threat actors targeted unpatched FortiSIEM instances to gain privileged access, deploy malware, and establish persistence within enterprise environments, impacting security visibility and putting sensitive data at risk. Public advisories highlighted patch urgency, as exploitation was observed globally in both private and government sectors. This incident underscores sharp escalation in exploitation of high-impact vulnerabilities immediately following public disclosure and POC release. The attack illustrates the need for rapid patching, robust segmentation, and comprehensive monitoring, as threat actors increasingly automate targeting of critical management infrastructure.
8 months ago
Kill Chain
Black Basta Ransomware Boss Named, Placed on Interpol Red Notice in Major 2026 Crackdown
In January 2026, international law enforcement, led by Ukraine and Germany, identified Oleg Evgenievich Nefedov as the leader of the Black Basta ransomware-as-a-service (RaaS) gang. Authorities added Nefedov to Interpol's 'Red Notice' and Europol's 'Most Wanted' lists, following coordinated raids that apprehended affiliates specializing in breaching corporate systems, cracking passwords, and escalating privileges to facilitate attacks. Black Basta has been attributed to over 600 global cyber incidents targeting enterprises in sectors from defense to healthcare, employing ransomware and data extortion to extract payments and exfiltrate sensitive information. This incident is significant as it marks one of the first times a major ransomware operation's leadership was officially unmasked and targeted with international warrants. The Black Basta takedown reflects increasing sophistication and coordination in responses to organized cybercrime, underscoring the persistent threat posed by ransomware groups and their rapid evolution post-Conti.
8 months ago
Kill Chain
China-Linked APT Exploits Cisco Secure Email Gateway Zero-Day (2025)
In late 2025, Cisco disclosed a critical zero-day vulnerability (CVE-2025-20393, CVSS 10.0) within AsyncOS Software powering its Secure Email Gateway and Secure Email and Web Manager appliances. Exploited by China-linked advanced persistent threat group UAT-9686, the flaw—residing in insufficient HTTP request validation by the Spam Quarantine feature—allowed attackers to remotely execute commands as root, install tunneling and persistence tools, and drop a Python backdoor ("AquaShell"). The threat actor’s campaign saw exploitation in the wild ahead of Cisco’s January 2026 patch release, impacting organizations exposing affected appliances to the internet with the vulnerable feature enabled. This incident highlights the increasing sophistication and operational tempo of state-backed APTs exploiting zero-day vulnerabilities in enterprise infrastructure. The case underscores the urgency for rigorous patch management, network segmentation, and rapid detection as attackers target critical security appliances that serve as organizational communication lifelines.
8 months ago
Kill Chain
GootLoader’s Malformed ZIP Attack: 2026 Lessons for Enterprise Security
In January 2026, security researchers uncovered a sophisticated GootLoader malware campaign leveraging malformed, hashbusting ZIP archives containing JavaScript payloads. These ZIP files, crafted by concatenating 500–1,000 archives and manipulating ZIP header fields, evaded analysis from most extraction tools except Windows' default unarchiver. Distributed via SEO poisoning and malvertising targeting legal template seekers, the attack delivered unique archives to each victim, successfully bypassing many detection workflows. Once executed, the JavaScript payload established persistence and launched additional scripts to gather system info and await remote instructions—potentially leading to further infections, including ransomware. This incident underscores the rising technical sophistication in malware delivery tactics, with adversaries rapidly adapting to security controls by exploiting common utilities and unique, randomized delivery artifacts. The campaign highlights the need for proactive endpoint controls and continuous monitoring, as many legacy detection and response tools may miss such creative evasion methods.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports