(FORTUNE Magazine) – First it was kidney failure and diabetes. Then, for a 40-year-old Michigan woman this June, the diabetes led to foot ulcers and gangrene. One toe had to be amputated, then a second, then a third.

Worse followed.

The woman's doctors knew how to stem her gangrene. They knew how to maintain her on dialysis too. But they'd failed to keep a microbe called Staphylococcus aureus from invisibly contaminating the woman's dialysis catheter, as well as the ulcers on her foot. The bugs proved resistant not only to every drug in the penicillin family--by now, penicillin-resistant infections in hospitals have become routine--but also to all variants of methicillin, a drug once touted as the replacement for penicillin. Grimly, the woman's doctors gave her their standard drug of last resort: intravenous vancomycin.

This time, the nightmare that doctors around the world had been dreading for more than a decade came true. Vancomycin failed completely. If the bug could not be stopped, it would infect the woman's bloodstream, attacking her vital organs and causing high fever, plummeting blood pressure, systemic infection, and ultimately, death.

To many doctors who read the tersely worded news in a July bulletin from the Centers for Disease Control and Prevention, the Michigan case was a harbinger of a future in which antibiotics increasingly may not work, a future very much like the pre-penicillin past, when unstoppable infections killed the majority of seriously ill hospital patients. In that dark past--which ended only 60 years ago--S. aureus was the bug that reigned supreme. Today, among the hospital bacteria that prey on weakened patients like the Michigan woman, it remains the most aggressive and lethal, the most widespread, and among the fastest to develop resistance to each new antibiotic.

Bugs like S. aureus roam hospitals freely, spreading by contact on the hands of a doctor or nurse, on a stethoscope or a bed railing. The more resistant they become, the greater the threat. Strict hygiene can prevent their spread, but few hospitals manage to maintain it, especially in busy intensive-care units and operating rooms. A lengthy investigative report in the Chicago Tribune this summer concluded that half of doctors fail to adhere to clean-hand policies established by the Centers for Disease Control.

Hospitals typically veil deaths from such infections in generalities. When an obituary reports the cause of death as "complications from surgery," it most likely means multi-drug-resistant S. aureus. The CDC reckons that of ten million Americans entering hospitals each year, 40,000 will die as a result of bacterial infections contracted during their stay--as many as die in car wrecks and twice the number who die of AIDS. S. aureus accounts for the bulk of those hospital deaths.

Many victims are old, with chronic conditions that weaken their immune systems. Trauma patients--victims of car crashes or bad burns--are also especially vulnerable, as are cancer patients in for radiation or chemotherapy, and newborns. But anyone entering a hospital for surgery can get it, a weekend athlete in for a knee repair, say, or an otherwise healthy person in for a bypass.

With the emergence of vancomycin-resistant staph, the danger is sure to get worse. Pharmacists have no new antibiotic that is as broadly effective as vancomycin. Traditional sources of antibiotics are tapped out, and new ones from the genomics revolution are at least five years away. The brightest hope may not be an antibiotic at all, but a vaccine from an obscure biotech company called Nabi Biopharmaceuticals, in Boca Raton, Fla. But even that is a couple of years off--scant reassurance for anyone entering a hospital today.

To battle-weary doctors and research scientists, S. aureus sometimes seems like a demonic adversary. Seen through a microscope, its round cells look like inviting golden grapes--hence the name, an amalgam of the Greek words staphule (bunch of grapes) and kokkos (grain) and the Latin aureus (golden). Usually S. aureus lives unnoticed on our skin or in our noses; a third of us are colonized with it. But once the bug reaches the bloodstream of an immunocompromised host, it infects one organ after another, causing them to fail. Often, as if intuiting its prey's weakest spots, it seeks out the heart and the brain, both difficult-to-reach sites for antibiotics, or the lungs, where it causes pneumonia. It can also cause bloodstream infections, dispatching toxins like so many torpedoes and causing the immune system to overreact in a cataclysm of toxic shock.

S. aureus is the bug that penicillin was designed to fight (the world's first antibiotic also worked against bacteria like Enterococcus faecium, an intestinal bug that enters the bloodstream to infect heart valves or cause other mayhem, and Streptococcus pneumoniae, which causes meningitis and pneumonia). Within two years of penicillin's introduction in the early l940s, S. aureus became the first bacterium to develop resistance, changing one of its genes so that penicillin could no longer attach to its cell wall and block the bug from replicating. A few scientists, marveling at this elegant Darwinian parry, wondered if a vaccine might be the better way to stop S. aureus before it had a chance to breed and mutate. But antibiotic compounds seemed as plentiful as the soil from which they mostly came--soil bacteria having evolved them naturally over eons to fight each other--and the vaccine idea went nowhere.

Vancomycin was an early discovery in the fight against staph, but it took decades to come into its own. Derived from a soil bacterium in Borneo in the early l950s, it works much like penicillin, stopping S. aureus from replicating by blocking its cell-wall-building process. Unlike penicillin, though, vancomycin acts like a giant mitt, clamping down on five different genes that operate in concert. When it first hit the market in 1958, doctors shunned it because it has toxic side effects; they'd been spoiled by penicillin, which has none. But as one strain after another of S. aureus, E. faecium, and other bugs acquired resistance to penicillin and its many successors, vancomycin emerged as the drug of choice--often the only choice--for many infections. Doses cost about $14 a day; last year, creator Eli Lilly sold $210 million of vancomycin globally, and generic equivalents accounted for another $300 million in sales.

Despite a nasty and inexplicable penchant for causing severe pain at the point where it enters the body, vancomycin had one unassailable advantage. No bug had ever become resistant to it. And none ever would. Or so went the logic as its use soared in the early l980s. After all, the odds against a bacterium like S. aureus mutating all of the five genes that the drug targets, then making five new ones work together just as well, seemed astronomical.

The more widely vancomycin was used, though, the more chances the bugs had to find ways around it. In addition, bacteria have a key evolutionary advantage that more complex organisms lack: They readily swap genes between species. The bacterium that first managed to develop vancomycin resistance was E. faecium, which is a more benign pathogen than S. aureus, though still no fun. In the late l980s and early 1990s a new multi-gene mechanism of resistance appeared and was passed along from strain to strain of E. faecium. Today in most U.S. hospitals vancomycin-resistant E. faecium, or VRE, is endemic: a ubiquitous nuisance that doctors have given up trying to contain.

At least, doctors knew, VRE rarely kills on its own. But what if it passed its new genetic tricks to S. aureus? For more than a decade that was the worst-case scenario in debates about bacterial infections. Most experts felt the trade would never occur, because VRE is a gastrointestinal bug that rarely encounters S. aureus. But the experts were wrong. In the Michigan woman's body, somehow that's exactly what happened.

The patient herself? She survived. When vancomycin failed, her doctors in desperation tried trimethoprim and sulfa, old antibiotics that many strains of S. aureus readily defeat. In this case they brought the infection under control. But that's cold comfort to William Jarvis, head of hospital infections for the CDC, who knows that bacteria ultimately never fail to disseminate new survival mechanisms.

Almost inevitably, Jarvis observes, more cases of vancomycin-resistant S. aureus, or VRSA, will crop up--some of them utterly impossible to cure. The Michigan woman's infections were easy for her doctors to reach with the other antibiotics. "Next time we might get a brain abscess, or endocarditis, or a serious bone infection, where it's hard to get a high concentration of antimicrobial," Jarvis says. Patients will die, and vancomycin resistance will spread. That's what worries Jarvis: "We have a large and growing population of patients colonized with both VRE and methicillin-resistant staph. They're an increasingly large time bomb waiting to go off. If and when VRSA does spread, this will wreak havoc for us."

Always before, the world's pharmaceutical companies have been ready to meet the emergence of a killer bacterium like VRSA with a new antibiotic. Now the system has failed. Part of the problem is scientific: Nature seems to have yielded all its obvious antibiotics from soil bacteria and fungi; few drug companies even bother to sift soil for new prospects anymore. The newly sequenced genomes of S. aureus and other bad bugs suggest a dizzying number of untried genetic targets, but developing drugs to hit them will take years. The result, in the words of George Poste, former chief scientist of SmithKline Beecham, is a "window of vulnerability" during which S. aureus and other bugs will grow increasingly resistant without new drugs to stop them. (He predicts new antibiotics may reach the market around 2007.)

Money is the other big reason that pharmacists' shelves are bare. For major drug companies, antibiotics are not the road to riches. The big money in recent years has been in blockbuster drugs to treat chronic aging-related disorders--high blood pressure, cholesterol, depression--medicines that patients typically stay on for years. This year alone, Lipitor, the No. 1 seller, is expected to generate $8 billion in sales for Pfizer. By contrast, the biggest new antibiotics, Pharmacia's Zyvox and Aventis's Synercid, this year are expected to generate $200 million and $30 million, respectively. A number of drug companies, including Eli Lilly, have simply shut down their antibiotics programs.

In the early 1970s a small group of researchers at the National Institutes of Health saw many of these problems coming. They wondered if antibiotic resistance, even then a growing threat, represented an opening for vaccines. Might not prevention ultimately prove a better strategy than cure against enemies as complex and changeable as S. aureus and E. faecium? Pursuing the idea took them far outside the scientific mainstream.

"You're dealing with a group of people who are viewed as a bit cuckoo," admits John Robbins, a research physician who, with his colleague Rachel Schneerson, has helped spearhead vaccine work at the NIH for 30 years. Robbins speaks with the wry satisfaction of a contrarian who's been proven right more than once. Through their long careers, he and Schneerson have created four successful antibacterial vaccines: for Haemophilus influenza type B, whooping cough, typhoid, and Streptococcus pneumoniae. That's a record unequaled by anyone else in the world, though as Robbins dryly observes, few scientists have bothered to try.

"Vaccines have not been a profitable industry," Robbins says. What he means is that vaccines are an even worse business than antibiotics. They are harder to create and harder to prove effective, and since they are generally given to healthy people, says Robbins, you need to be certain they don't harm their human host. "You have to test vaccines far more than antibiotics," he adds, "because they're the only medicines you give routinely to people who cannot give informed consent: children." Only a handful of big drugmakers--Merck, Wyeth, Aventis, and GlaxoSmithKline among them--even have vaccine programs. Yet in theory, at least, vaccines have a huge advantage over antibiotics: They knock out the bugs before the bugs can develop resistance.

S. aureus was by far the wiliest bug that Robbins and his team set out to combat. Many other bacteria have a capsule-like outer casing that makes a ready target for vaccines; S. aureus seemed to have none. That stymied all efforts until Robbins's colleague Walter Karakawa intuited that the bug grows differently in people than in a lab dish. Developing a promising vaccine took 17 years. In 1991 the NIH researchers finally were ready to run a so-called Phase I clinical trial to test the safety of the vaccine on healthy volunteers. Not only did it prove safe, but to the researchers' delight, it also stirred production of lots of S. aureus-destroying antibodies in the volunteers' bloodstreams.

As government scientists, however, they'd gone as far as they could go. The NIH had neither the funds nor the mandate to take the vaccine to market--in drug research and development, Washington often funds the R, but leaves it to business to fund the D. The idea of an S. aureus vaccine was still so unorthodox that Big Pharma shunned it. Instead, in 1991, a small biotech, which soon merged into Nabi Biopharmaceuticals, licensed the NIH vaccine to try to take it to market. One of Robbins's proteges, Ali Fattom, an Israeli-born Palestinian researcher who relishes uphill battles, went with it.

A $200-million-a-year maker of immunity-related medicines, publicly held Nabi is one of dozens of midsized drug companies hoping to corner a whole new market. Then-CEO Tom Stegnero wasn't sure what he had when he first licensed the NIH vaccine. But over the next eight years, Nabi pumped some $100 million into the vaccine as Fattom took it methodically through animal tests and Phase II clinical trials. The results suggested that the vaccine could protect sick patients for a year or more. Along the way, Nabi gave the product a name: StaphVax.

By 1999 the company was at a crossroads. The final step to winning FDA approval to put StaphVax on the market was to conduct a successful Phase III trial that would prove the vaccine's effectiveness on large numbers of patients. CEO David Gury and senior VP of quality and product development Bob Naso sensed an opportunity to pioneer a huge new market. "This has a chance to be a $1 billion product," says Naso, a former Johnson & Johnson researcher who joined the company in 1992. A dramatically successful Phase III trial, they figured, would jump-start demand. So Nabi decided to bet very aggressively with the goals it set for the trial.

To flaunt the vaccine's power, the company picked as its target group "end stage" renal patients--people with permanent kidney failure, whose reliance on dialysis made them particularly vulnerable to infection through their catheters. The objective was to show that a single StaphVax injection would safeguard them against S. aureus infections in the blood for a full 54 weeks. Nabi rejected the idea of conducting a lower-risk trial, testing Staph- Vax on, say, healthy people scheduled for knee surgery. But as Naso observes, such a trial wouldn't prove the vaccine worked on long-term high-risk patients, and that was much too big a market to ignore. A trial that protected the sickest patients, on the other hand, might inspire the FDA to sanction the vaccine for everyone at risk from S. aureus, making StaphVax a blockbuster drug. A top drug company scientist says of Nabi's aggressive approach, "That took balls."

The trial, which began in April 1999, cost Nabi tens of millions of dollars. To administer it, the company hired Kaiser Permanente, the $20-billion-a-year Oakland health maintenance organization. Kaiser selected some 1,800 end-stage renal patients; half were given the vaccine, the rest a placebo. The patients were then periodically monitored for antibodies in their blood that would protect them against S. aureus infections. When the results were tabulated after 54 weeks, however, StaphVax had failed. Though vaccinated patients had shown immunity to S. aureus at times during the first ten months of the trial, by the end of 54 weeks the vaccine had worn off.

Nabi put a glass-half-full interpretation on the results. From its standpoint, StaphVax had proved itself ready for market--as a ten-month vaccine. The FDA did not see it that way. In January 2001 it ruled that because StaphVax had failed to meet the trial's goal, it could not be approved. Instead the government invited Nabi to conduct another Phase III trial. Would the FDA have approved StaphVax if Nabi's trial had been less grandiose? Shrugs Dr. Harvey Shinefield of Kaiser Permanente, who oversaw the work: "The retrospectoscope is a very interesting instrument, but it's never helpful when you need it."

Shinefield's report on the trial, published in February in the New England Journal of Medicine, nevertheless startled the field. For advocates of antibacterial vaccines, the results were a landmark success. What's remarkable, says Robbins of the NIH, is that patients with depressed immune systems built up immunity during the course of the trial. "The fact that [the vaccine] works here is one step short of a miracle," he says. Dr. Richard Novick of the New York University medical school, an international authority on infectious disease and for years a skeptic about the feasibility of an S. aureus vaccine, says the report is persuasive: "I have to confess that I am coming around to the view that there may well be something in the idea."

Others think the FDA made the right call. Says Robert Daum, a pediatrician and leading expert on S. aureus at the University of Chicago Hospital: "I know that study inside and out and have concerns about the effectiveness of the vaccine." Daum observes that the vaccine was only effective sporadically. If it had prevented S. aureus infections unequivocally during the first months of the trial, he says, "the FDA would not ask them to do the trial again."

Nabi is still regrouping from the setback. Its stock, which traded at close to $11 a share at the start of the trial, recently sold for half that price. This spring Nabi sold off a large chunk of its business to pay down debt and build a $46 million war chest to develop StaphVax and other promising drugs. "We've worked out the details for the FDA," Naso says with a sigh about the next Phase III trial for StaphVax. "We'll pick eight months as an end point." The trial may begin in early 2003. Two other approaches to an S. aureus vaccine are also in the works, at Inhibitex of Alpharetta, Ga., and at Harvard's Channing Laboratory. But neither is as far along as Nabi's. At best, then, if StaphVax succeeds, a vaccine that might protect millions of people each year from deadly S. aureus infections won't be available until 2005.

Until then, S. aureus will roam with increasing impunity. And even if StaphVax does reach the market, that won't be the end of it. Doctors now realize that humanity's seesawing battle with S. aureus will never cease. Says Pharmacia senior scientist Chuck Ford: "I'll bet you a paycheck that you could put that vaccine on the market, and Staph would rebound with things you never thought of and be out there smiling. We've been waging war with this son of a bitch for a long time."

Shinefield knows that all too well. The Kaiser Permanente vaccinologist, who is in his late 70s and likes to walk miles each day for exercise, was in the very act of writing his New England Journal of Medicine report when a cracked heel allowed S. aureus on his skin to enter his foot. Shinefield's particular strain caused necrotizing fasciitis, consuming layers of his skin with devastating speed and turning them black. In days the infection ate most of the foot away: "It looked exactly like the Gray's Anatomy foot," he says. The doctor was forced to undergo seven operations in a week to debride dead flesh and drain more than a pint of pus, and was then put on a six-week course of methicillin. Eighteen months later his foot is still healing. "S. aureus was looking to get back at me," Shinefield jokes. "If only I'd taken the vaccine I was studying... "

MICHAEL SHNAYERSON is co-author, with Mark J. Plotkin, of The Killers Within: The Deadly Rise of Drug-Resistant Bacteria, published this month by Little Brown. feedback fortunemail_letters@fortunemail.com.