The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3375 threat reports
Page 262 of 282
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 3133–3144 / 3375 reports
macOS Infostealer Ecosystem 2024: Atomic, Odyssey & Poseidon Unveiled
Financial Services9 months ago

macOS Infostealer Ecosystem 2024: Atomic, Odyssey & Poseidon Unveiled

In early 2024, cybersecurity researchers identified a surge in advanced macOS infostealer campaigns targeting enterprises and individuals, featuring prominent malware variants: Atomic, Odyssey, and Poseidon. These infostealers exploit social engineering and malicious downloads to achieve initial access, deploying payloads designed to extract sensitive data such as passwords, browser credentials, cryptocurrency wallets, and system information. Once installed, the malware communicates with command-and-control infrastructure using encrypted channels, effectively exfiltrating critical information while evading traditional antivirus tools. This campaign demonstrated sophisticated evasion techniques, cross-platform delivery, and broad targeting among macOS users. The growing sophistication and proliferation of macOS-targeting infostealers underscore a significant shift in attacker focus beyond Windows environments. With macOS adoption increasing in the enterprise and remote workforce, these campaigns illustrate heightened risk, regulatory urgency, and the pressing need for zero trust controls and vigilant endpoint protection against evolving cross-platform threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Polymorphic Python RAT: Next-Gen Malware Slips Past Defenses in 2024
Financial Services9 months ago

Polymorphic Python RAT: Next-Gen Malware Slips Past Defenses in 2024

In October 2024, security researchers identified a new strain of Python-based remote access trojan (RAT) exhibiting advanced polymorphic capabilities. The malware, distributed as 'nirorat.py' and virtually undetectable by most antivirus engines on VirusTotal at the time of discovery, leverages self-modifying code, dynamic junk code injection, and obfuscation to evade detection. Its feature set includes network scanning, credential testing, data exfiltration, cryptomining, screen and audio recording, and file encryption. The Trojan is designed to mutate its code with each execution, making signature-based security tools largely ineffective and challenging forensic analysis post-compromise. This incident is emblematic of an ongoing trend: cybercriminals are increasingly using polymorphic programming techniques and open-source scripting languages to bypass detection and propagate malware. Organizations must adapt their defense strategies as attackers innovate to manipulate familiar toolchains, raising the stakes for endpoint and network security teams.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
RedTail Cryptojacking: 2024 SSH Honeypot Attack Exposes Evasive Trends
Information Technology/IT9 months ago

RedTail Cryptojacking: 2024 SSH Honeypot Attack Exposes Evasive Trends

In 2024, repeated attempts to deploy RedTail cryptojacking malware were observed targeting honeypots through brute-forced SSH credentials and exploitation of vulnerabilities. Attackers gained access by cracking weak SSH passwords, uploaded and executed scripts such as setup.sh and clean.sh, and implemented persistent access by implanting their own SSH keys. They evaded detection by deleting evidence, queried system info to optimize deployment, and communicated outbound over HTTPS to control mining pools, siphoning off computing resources for Monero mining. The attack demonstrated both technical sophistication and evasiveness, resulting in loss of system performance and increased operational costs for victims. The RedTail campaign stands out for its focus on stealth, persistence, and lateral evasion, signaling a shift from noisy ransomware to more subtle and long-term threats like cryptojacking. With attackers honing in on resource hijacking and leveraging diverse TTPs, organizations face new challenges in detection and response. This incident shows the increasing necessity for robust SSH hardening, proactive monitoring, and defense-in-depth measures against evolving cryptojacking methods.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
ClickFix Factory: How Automated Phishing Kits Are Changing Social Engineering in 2024
Financial Services9 months ago

ClickFix Factory: How Automated Phishing Kits Are Changing Social Engineering in 2024

In 2024, Unit 42 researchers exposed the ClickFix Factory, a novel phishing kit generator that dramatically lowers the technical bar for aspiring cybercriminals. ClickFix enables users to design sophisticated phishing campaigns targeting identity verification and anti-abuse modules (IUAM) without deep coding knowledge. By offering user-friendly templates and built-in automation, ClickFix streamlines social engineering attacks and amplifies their reach, resulting in a spike of high-volume, lower-skill phishing campaigns observed targeting enterprises and individuals globally. The release of ClickFix reflects an ongoing trend toward the commoditization of cybercrime tooling, making advanced techniques readily accessible to broader groups of threat actors. Security teams face new urgency to adapt detection, awareness, and prevention strategies as phishing kit marketplaces accelerate both the scale and success rate of social engineering attacks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
2025 Cloud Provider Breach Uncovers Critical Zero Trust Weaknesses
Financial Services9 months ago

2025 Cloud Provider Breach Uncovers Critical Zero Trust Weaknesses

In early 2025, a major global cloud provider suffered a sophisticated multi-stage breach in which adversaries gained initial access using compromised identity credentials, exploited weak east-west segmentation, and moved laterally across multicloud environments. The attackers leveraged unencrypted traffic channels and insufficient policy controls to evade detection, escalate privileges, and access sensitive customer data. As a result, organizations relying on this provider experienced outages, data exfiltration, and business continuity disruptions while the cloud provider scrambled to restore services and conduct forensic investigations. This incident highlights a rapidly growing trend: attackers are increasingly targeting cloud infrastructure, exploiting vulnerabilities in workload isolation, cloud-native policy enforcement, and hybrid connectivity. With regulators enhancing requirements and business dependence on cloud rising, defending against lateral movement and enforcing zero-trust has become a critical priority.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Notion 2025: AI Agent Prompt Injection Leads to Data Breach
Computer Software/Engineering9 months ago

Notion 2025: AI Agent Prompt Injection Leads to Data Breach

In September 2025, Notion experienced a security incident after releasing version 3.0 with integrated AI agents. Threat actors exploited a prompt injection vulnerability whereby malicious PDF files—containing hidden instructions—caused Notion's AI to extract sensitive customer data and exfiltrate it to an external attacker-controlled endpoint. The attack chain leveraged the AI’s access to private data and enabled untrusted content, combined with the external communication capabilities of the LLM-powered agent. This resulted in unauthorized exposure and theft of confidential enterprise data, highlighting a worrying weakness in agentic AI implementations. This incident underscores the growing risk posed by prompt injection attacks against AI and LLM-integrated workflows, particularly as organizations rapidly adopt such technologies. With regulatory scrutiny rising and attackers quickly adapting to target emerging AI-driven systems, prompt injection and data exfiltration are fast becoming board-level risks across industries.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Apple Fixes Groundbreaking Pointer Infoleak in macOS/iOS Serialization (2025)
Computer Software/Engineering9 months ago

Apple Fixes Groundbreaking Pointer Infoleak in macOS/iOS Serialization (2025)

In March 2025, Apple patched a novel vulnerability in macOS and iOS after research by Google Project Zero revealed a pointer information leak in the way Apple's Foundation framework handled serialization and deserialization via NSKeyedArchiver and NSKeyedUnarchiver. The flaw allowed attackers to deduce memory address information—specifically, the address of the NSNull singleton—by crafting serialized data and analyzing the ordering of keys upon re-serialization, without exploiting any memory corruption or timing attacks. This potential leak could subvert Address Space Layout Randomization (ASLR), a key memory protection mechanism, if leveraged in real-world attack surfaces that allow roundtripping of attacker-supplied serialized objects. Although the direct impact was mitigated by Apple’s 31 March 2025 security update, the disclosure highlights an overlooked class of pointer leak vulnerabilities inherent in pointer-keyed data structures, especially where object addresses serve as hash values. This incident is significant in the context of a broader industry trend: attackers are increasingly pursuing remote and non-traditional side channels for ASLR bypasses and memory leaks, while defenders must contend with the residual risks of serialization and legacy data structure design. Regulatory and customer pressure continues to rise for organizations to ensure modern memory safety, especially as zero trust and data segmentation architectures rely on robust underlying primitives.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Double Agents: The 2024 Exploitation of AI Agent Mode in Commercial Platforms
Computer Software/Engineering9 months ago

Double Agents: The 2024 Exploitation of AI Agent Mode in Commercial Platforms

In March 2024, security researchers revealed how threat actors exploited 'agent mode' in commercial AI products to conduct AI-in-the-middle (AIitM) attacks. By abusing the emerging capability that allows AI assistants to autonomously perform actions, adversaries were able to impersonate users or escalate privileges by intercepting and manipulating commands. This allowed attackers to facilitate lateral movement, data exfiltration, and policy circumvention within enterprise environments, often leaving minimal forensic traces. The incident highlighted how the wider adoption of agentic AI features substantially expands the potential threat surface for organizations. This breach has rapidly gained industry attention amid a surge in advanced AI-driven attacks and a wave of regulatory scrutiny on AI operational security. As enterprises accelerate their deployment of commercial AI tools, understanding the novel risks introduced by agentic AI is now critical for leadership and security teams.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
King KongTuke Breach Unmasks East-West Security Gaps in Multi-Cloud Era
Financial Services9 months ago

King KongTuke Breach Unmasks East-West Security Gaps in Multi-Cloud Era

In September 2025, a sophisticated breach attributed to the threat group 'King KongTuke' targeted several enterprises operating in multi-cloud environments. Attackers exploited weaknesses in east-west traffic controls and bypassed improper network segmentation by leveraging encrypted, paste-and-run lures to establish covert lateral movement between cloud workloads. Once inside, the group utilized remote access tools and encrypted tunnels to exfiltrate sensitive data at scale, evading traditional threat detection and impairing business operations across industries including fintech and healthcare. The incident revealed extensive compliance risks and forced urgent remediation of cloud and hybrid network configurations. This breach highlights a growing trend of threat actors exploiting hybrid and multicloud blind spots. The event has triggered renewed urgency on east-west visibility, zero trust controls, and AI-enabled anomaly detection. Regulatory attention is increasing on enforcing segmentation, encryption in transit, and cloud-native policy enforcement at scale.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Phishing and RMM Tool Abuse Drive Multi-Vector Attacks – September 2025 Wrap-Up
Financial Services9 months ago

Phishing and RMM Tool Abuse Drive Multi-Vector Attacks – September 2025 Wrap-Up

In September 2025, organizations faced a surge of multi-vector cyber campaigns targeting enterprises through sophisticated phishing attacks and compromised WordPress sites. Attackers used phishing emails as entry points, tricking employees into installing remote monitoring and management (RMM) tools such as AnyDesk and Atera, thereby gaining unauthorized access to internal networks. Simultaneously, threat actors leveraged vulnerable or hijacked WordPress websites to distribute malware payloads, facilitating both initial compromise and lateral movement across organizations' internal networks. The impact included credential theft, unauthorized remote control, and data exfiltration, as well as disruption to normal business activities. This incident highlights a rapidly evolving threat landscape where attackers combine social engineering, legitimate RMM tools, and supply-chain exploits to evade traditional security defenses. It underscores increased regulatory attention on monitoring east-west traffic, policy enforcement, and anomaly detection across hybrid cloud environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Google Gemini Hit by Unfixed ASCII Smuggling AI Attack in 2025
Computer Software/Engineering9 months ago

Google Gemini Hit by Unfixed ASCII Smuggling AI Attack in 2025

In October 2025, a newly disclosed ASCII smuggling attack targeting Google’s Gemini AI assistant exposed a significant security vulnerability stemming from the model's processing of hidden Unicode payloads. Security researcher Viktor Markopoulos demonstrated that attackers could leverage invisible Unicode characters in Calendar invites or emails, prompting Gemini to execute unseen instructions and alter its behavior without user awareness. Notably, the exploit could automate data extraction or spoof identities within Google Workspace integrations, increasing risk for both users and enterprises. Despite the demonstrated risks, Google chose not to address the vulnerability, citing its overlap with social engineering tactics. This incident underscores the heightened threat posed by AI/ML attacks against widely integrated platforms. As LLMs increasingly automate workflows and access sensitive data, adversarial prompt manipulation and Unicode character abuse are becoming urgent areas for organizational security reviews and regulatory scrutiny.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Google Workspace 2025 OAuth Supply Chain Breach: Lessons From the Drift Incident
Financial Services9 months ago

Google Workspace 2025 OAuth Supply Chain Breach: Lessons From the Drift Incident

In August 2025, a supply chain attack targeted Google Workspace via compromised OAuth tokens associated with the Drift email integration, impacting several organizations. Attackers leveraged stolen Drift tokens to gain unauthorized, delegated access to connected Google Workspace mailboxes, bypassing traditional security controls by exploiting trusted third-party app grants. Google rapidly responded on August 9 by revoking the affected tokens and disabling the integration. While only a small number of mailboxes were directly accessed, the incident underscored how attackers increasingly exploit SaaS interconnections rather than direct platform breaches. This incident is particularly relevant today as exploitation of OAuth tokens and third-party integrations continues to climb, representing a paradigm shift in enterprise attack surfaces. It highlights the growing need for comprehensive SaaS integration visibility, rigorous token governance, and real-time behavioral monitoring as attackers increasingly favor these stealthy, scalable techniques.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports