LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Threat Intel

Attackers are shipping malware dressed up as a Philips DICOM viewer

MedDevice Cyber Staff · Feb 26 · 2 min read · Via Philips Product Security

Philips issued an advisory in February 2025 warning that malware was circulating impersonating its legitimate DICOM Viewer software. No CVE, because this is not a bug in the product. It is criminals using the product name as bait to get a payload onto clinical machines, and the victim thinks they are installing the real viewer.

You cannot patch brand impersonation. You counter it with signed installers, an obvious official download path, and takedowns. Your software name is a trust signal, and attackers will keep borrowing it until the legitimate download is obvious enough that the fake one looks wrong.

Sources

Philips Product Security ↗

Questions & Answers

Is there a vulnerability in the Philips DICOM Viewer?

No CVE was involved. Philips warned in February 2025 that malware was circulating impersonating its legitimate DICOM viewer software, using the product name as bait to get a payload onto clinical machines.

How do you defend against software brand impersonation?

Signed installers, one obvious official download path, and takedowns. Users should get the viewer only from the vendor’s site and check signatures before install.

← Back to Threat Intel

Attackers are shipping malware dressed up as a Philips DICOM viewer

Questions & Answers

Is there a vulnerability in the Philips DICOM Viewer?

How do you defend against software brand impersonation?

More Threat Intel