gilead.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting gilead.com, with 56,160 historical data breaches and 1,957 active infostealer logs observed between July 2025 and June 2026. The majority of these events are linked to "Combolist sources" (64.6%) and "Database dumps" (35.4%), suggesting compromised credentials are a primary vector. Malware analysis reveals a strong prevalence of "Redline" (92.2%), a known infostealer, alongside other threats like "LummaC2" and "Rhadamanthys". The timeline shows a substantial spike in employee-related events in September 2025 and January 2026, with client-related events also peaking in September 2025. Targeted services include gilead.com itself and its federated single sign-on (fedsso3.gilead.com) and grant portals, with a notable concentration of affected operating systems being older 32-bit Windows Server and client versions, indicating potential vulnerabilities in legacy systems. The high volume of data breaches and infostealer activity, coupled with the use of prevalent credential-harvesting malware like Redline, presents a critical risk. The focus should be on immediate credential hygiene, including mandatory password resets for all employees and clients, and enhanced monitoring for suspicious login activity, particularly on federated services. A thorough review and patching of all identified legacy operating systems and services, especially those related to authentication and grants, is paramount to mitigate further exploitation. The prevalence of combolists suggests a need to investigate the source of these compromised credentials and implement stronger authentication mechanisms.