Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Banking/Mortgage

Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.

625 threat reports
Page 1 of 53
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Banking/Mortgage Threat Reports

Showing 1–12 / 625 reports
LNbits Lightning Wallet Exploit: How Attackers Drained Bitcoin from Self-Hosted Servers Before a Patch Existed
LNbits Lightning Wallet Exploit: How Attackers Drained Bitcoin from Self-Hosted Servers Before a Patch Existed
Financial Services6 hours ago

LNbits Lightning Wallet Exploit: How Attackers Drained Bitcoin from Self-Hosted Servers Before a Patch Existed

In November 2026, LNbits—a widely deployed open-source Bitcoin Lightning wallet platform—was actively exploited through an application-layer vulnerability in one or more of its extension modules, most notably the Paywall add-on. Attackers leveraged the flaw to withdraw approximately 2,285,545 satoshis (~0.023 BTC) from at least one confirmed operator before the project issued an emergency shutdown notice. The initial attack window ran from 09:22 UTC to 14:00 UTC on November 8, 2026—more than three hours before the first public warning. The LNbits team shut down its hosted cloud service and urged all self-hosted operators to take their servers offline while patches were being developed, with a 24–48 hour remediation estimate. This incident underscores the acute financial risk posed by application-layer exploits in self-hosted cryptocurrency infrastructure. As Lightning Network adoption grows among small businesses and developers, unpatched extension ecosystems and decentralized operator communities create broad, difficult-to-coordinate attack surfaces. The pattern mirrors broader trends of financially motivated threat actors targeting open-source fintech platforms with rapid, automated fund-extraction techniques.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Web3Auth Infrastructure Flaw Triggers Keplr Wallet Private Key Breach Across 44,000 Wallets
Web3Auth Infrastructure Flaw Triggers Keplr Wallet Private Key Breach Across 44,000 Wallets
Financial Services6 hours ago

Web3Auth Infrastructure Flaw Triggers Keplr Wallet Private Key Breach Across 44,000 Wallets

In November 2026, a security flaw in Web3Auth's infrastructure—the authentication provider powering Google and Apple sign-in for the Keplr crypto wallet—was exploited by a threat actor to obtain private keys for affected user wallets. The breach enabled unauthorized fund transfers across 19 blockchains, with blockchain analytics firm Bitquery tracking at least $6.01 million moving out of more than 44,000 wallets. Approximately 20% of Google and Apple login accounts were estimated to be at risk, with only a fraction confirmed stolen; Web3Auth preemptively emptied additional at-risk wallets into secure recovery addresses before the attacker could reach them. Web3Auth's embedded wallet service remains offline pending investigation. This incident highlights the systemic risk embedded in social-login and third-party authentication dependencies within Web3 applications. As decentralized finance platforms increasingly adopt OAuth-style onboarding to lower user friction, supply-chain compromise of a single authentication provider can cascade across thousands of wallets and multiple blockchain ecosystems simultaneously, amplifying both financial and reputational damage.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
ARTEX Agentic AI Framework Weaponized Against Financial Sector by Storm-3358
ARTEX Agentic AI Framework Weaponized Against Financial Sector by Storm-3358
Financial Services2 days ago

ARTEX Agentic AI Framework Weaponized Against Financial Sector by Storm-3358

In October 2026, Microsoft Threat Intelligence identified Storm-3358, a Cambodia-based financially motivated threat actor, deploying the agentic AI offensive framework ARTEX against financial sector organizations across Southeast Asia and globally. The campaign combined AI-driven automated scanning, exploitation of vulnerabilities including anonymous file upload and server-side request forgery (SSRF), and installation of open-source remote access trojans (WISP, vshell, AdaptixC2) for persistence and lateral movement. ARTEX agents leveraged compromised credentials and cloud identities at machine speed to escalate privileges and exfiltrate sensitive financial data, representing a significant escalation in AI-augmented attack capabilities targeting the financial sector. This incident marks a pivotal shift in the threat landscape: agentic AI frameworks now enable threat actors to compress the entire attack chain—from initial reconnaissance to data exfiltration—into minutes rather than days. As financially motivated groups adopt AI-native offensive tooling, defenders face compounding pressure to deploy equally adaptive, AI-informed security controls across hybrid and multi-cloud financial infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
How an AI-Augmented MITM Attack Exposed Every Chainalysis Customer's Credentials
Financial Services2 days ago

How an AI-Augmented MITM Attack Exposed Every Chainalysis Customer's Credentials

In late October 2026, blockchain intelligence firm Chainalysis suffered a multi-stage breach that escalated from limited identity metadata exposure to a full-scope credential compromise affecting all customers. Attackers initially leveraged offensive agentic AI techniques to harvest names, email addresses, user IDs, and role labels. A subsequent on-path (MITM) attack then exposed usernames, password hashes, and live session tokens for the entire customer base—which includes law enforcement agencies, financial institutions, and crypto businesses globally. Chainalysis took its login portal, Reactor, Data Solutions, KYT UI, and address-screening APIs offline while forcing password resets and API key rotations. This incident underscores an accelerating trend of AI-augmented offensive techniques combined with classic network interception attacks targeting high-value SaaS platforms. As threat actors increasingly weaponize agentic AI to automate reconnaissance and credential harvesting at scale, organizations that rely on these platforms for regulatory compliance and financial crime investigation face compounding operational and legal exposure.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How ARTEX's Agentic AI Breached Chainalysis, Exposed Every User Credential, and Shut Down Critical Services in Hours
How ARTEX's Agentic AI Breached Chainalysis, Exposed Every User Credential, and Shut Down Critical Services in Hours
Financial Services3 days ago

How ARTEX's Agentic AI Breached Chainalysis, Exposed Every User Credential, and Shut Down Critical Services in Hours

In late October 2026, blockchain analytics firm Chainalysis suffered a multi-front cyberattack executed via an agentic AI offensive framework, later identified as ARTEX, that leveraged automated scanning of public repositories and cloud environments to harvest credentials, session tokens, and password hashes across its entire user base. The attackers conducted an on-path attack exposing customer passwords, forced the company to take its KYT, Address Screening, Reactor, and Data Solutions platforms offline, and locked all impacted accounts. Chainalysis confirmed no investigation data was accessed or attribution data manipulated, but the breadth of credential exposure and service disruption underscored the severity of autonomous AI-driven intrusion campaigns now targeting the crypto and fintech sector. This incident is emblematic of a rapidly accelerating threat category in which agentic AI tools like ARTEX compress the attack lifecycle from initial reconnaissance to cloud exfiltration to under five minutes, eliminating the need for continuous human operator involvement. The campaign mirrors simultaneous attacks against Chainstack, OpenCode, Warp, and WorkOS, signaling an industry-wide wave of AI-powered credential theft that security teams relying on traditional perimeter and signature-based defenses are structurally unprepared to detect or contain.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
The Binance 2026 Breach Proves Your Signing Policies Are Probably Out of Date
The Binance 2026 Breach Proves Your Signing Policies Are Probably Out of Date
Financial Services3 days ago

The Binance 2026 Breach Proves Your Signing Policies Are Probably Out of Date

In October 2026, Binance suffered a multi-vector attack combining social engineering, misuse of an internal AI tool, and stolen credentials to gain unauthorized access to its wallet-signing service. A compromised DevOps laptop allowed the attacker to reach a service container and submit unauthorized withdrawal requests. Critically, the attacker exploited EIP-7702 delegation to place a standing instruction on a custody wallet, enabling repeated fund transfers—including assets deposited after the initial theft—without requiring additional signatures. Private keys were never extracted, yet valid signatures were obtained, demonstrating that a server with signing permissions can weaponize a protected key without possessing it. This incident exposes a growing blind spot in Web3 and financial platform security: signing infrastructure governance. As Ethereum evolves with EIP-7702, ERC-4337 UserOperations, Safe modules, and session keys, organizations that have not updated their signing policies, simulations, and monitoring rules remain exposed to authority-hijacking attacks that bypass conventional transfer-monitoring controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Anyone Could Rent a White House IP Address for Less Than a Dollar — Here's How It Happened
Anyone Could Rent a White House IP Address for Less Than a Dollar — Here's How It Happened
Government Administration4 days ago

Anyone Could Rent a White House IP Address for Less Than a Dollar — Here's How It Happened

Between October and November 2026, security researchers discovered that multiple residential proxy services—including Infatica, a program linked to Russian hosting operator Vladimir Fomenko whose infrastructure was used in 2016 U.S. election cyberattacks—were actively beaconing from the Executive Office of the President's network (AS2650). Layer3 Intel identified six IP addresses across 26 of 30 days, with 28 separate proxy services able to exit through the White House network, meaning anyone paying as little as 60 cents per gigabyte could route traffic through one of the most sensitive government networks in the world. The root cause was SDK-embedded proxy software silently installed via free consumer applications on staff devices. This incident underscores how supply-chain SDK compromise and insider-risk through consumer app usage can silently weaponize trusted government or enterprise networks as anonymous proxy infrastructure. As residential proxy networks proliferate—found in nearly 300 government networks and 65% of enterprise DNS environments—the risk of nation-state actors exploiting these footholds for reconnaissance, data exfiltration, or lateral movement has reached a critical threshold demanding immediate egress visibility and policy enforcement.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
mSecure Cloud Breach 2026: When Encrypted Vaults Become High-Value Targets
mSecure Cloud Breach 2026: When Encrypted Vaults Become High-Value Targets
Computer/Network Security4 days ago

mSecure Cloud Breach 2026: When Encrypted Vaults Become High-Value Targets

In November 2026, mSeven Software disclosed a cyberattack against its mSecure password manager platform in which a threat actor exfiltrated an encrypted customer database from mSecure Cloud. The breach affected all users who synchronized their password vaults through mSecure's cloud service. Although the stolen database was protected with AES-256 encryption under a zero-knowledge architecture, the company urged current and former customers to immediately change stored passwords, reset two-factor authentication, and remove existing passkeys. mSeven provided limited public transparency regarding the attack vector, the number of affected users, and whether any plaintext data was exposed, drawing significant customer frustration. This incident mirrors the 2022 LastPass breach pattern—where encrypted vault theft later enabled cryptocurrency theft via offline master-password cracking—highlighting that cloud-synchronized credential stores remain high-value targets. As password managers become ubiquitous in enterprise and consumer security stacks, attackers are increasingly focusing on the cloud infrastructure layer rather than the application itself, making cloud data protection and egress controls a critical priority.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
One Compromised Laptop, $6.3 Billion Gone: Dissecting the Binance TraderTraitor Attack Path
One Compromised Laptop, $6.3 Billion Gone: Dissecting the Binance TraderTraitor Attack Path
Financial Services6 days ago

One Compromised Laptop, $6.3 Billion Gone: Dissecting the Binance TraderTraitor Attack Path

In late October 2026, North Korea's TraderTraitor threat group executed the largest cryptocurrency exchange breach in history, stealing $6.3 billion from Binance in approximately 20 minutes. The attackers began by compromising a developer's laptop, then pivoted into an internal service container with withdrawal-request privileges. Exploiting an Ethereum account-delegation mechanism, they obtained transaction approval authority over a hot wallet and drained assets while bypassing Binance's normal approval controls—without using any leaked wallet keys. Binance froze roughly $3 billion and used its own reserves to replenish approximately 95% of affected assets. This incident follows the February 2025 Bybit breach ($1.5 billion) and illustrates an accelerating pattern of North Korean state-sponsored actors targeting crypto infrastructure through insider-path exploitation—manipulating trust relationships and privileged workloads rather than breaking perimeter defenses. With crypto-related theft attributable to DPRK-linked actors now exceeding 76% of all reported 2026 losses, enterprises across all verticals must re-examine blast-radius containment and lateral privilege controls.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-81648: How a CVSS 10.0 WordPress Plugin Flaw Is Handing Attackers Crypto Wallet Keys
CVE-2026-81648: How a CVSS 10.0 WordPress Plugin Flaw Is Handing Attackers Crypto Wallet Keys
Financial Services6 days ago

CVE-2026-81648: How a CVSS 10.0 WordPress Plugin Flaw Is Handing Attackers Crypto Wallet Keys

In November 2026, threat actors began actively exploiting CVE-2026-81648, a CVSS 10.0 critical vulnerability in the CryptoPayment Gateway WordPress plugin (versions 1.2.1–1.2.2). The flaw exposes an unauthenticated AJAX endpoint that allows attackers to delete arbitrary files, overwrite payment gateway configurations, and retrieve stored wallet credentials in cleartext—all without any login. Attack infrastructure was traced to anonymous, KYC-free VPS hosting providers. No patch exists; the plugin was removed from the WordPress Plugin Directory on August 28, 2026. Affected site operators are advised to immediately remove the plugin, rotate all wallet keys, and audit server logs for unauthorized changes. This incident highlights a growing trend of financially motivated threat actors targeting Web3 and cryptocurrency payment integrations embedded in mainstream CMS platforms. As crypto adoption expands in e-commerce, unpatched plugin vulnerabilities with cleartext credential exposure represent a high-value, low-effort attack surface that defenders must prioritize with network egress controls and anomaly detection.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
BTCPay Server Exploit Drains Bitcoin and Litecoin Hot Wallets: What Every Crypto Merchant Needs to Know
BTCPay Server Exploit Drains Bitcoin and Litecoin Hot Wallets: What Every Crypto Merchant Needs to Know
Financial Services6 days ago

BTCPay Server Exploit Drains Bitcoin and Litecoin Hot Wallets: What Every Crypto Merchant Needs to Know

In November 2026, threat actors actively exploited a critical vulnerability in BTCPay Server versions 2.4.1 and earlier, a widely-deployed self-hosted open-source cryptocurrency payment processor. Attackers targeted unpatched instances to drain Bitcoin and Litecoin directly from hot wallets, resulting in direct financial losses for merchants and payment processors relying on the platform. BTCPay Server's maintainers issued an urgent advisory confirming the attacks were exploitation-driven, urging all operators to immediately upgrade to the patched release. The incident underscores the compounding risk of unpatched open-source financial infrastructure exposed to the internet. This breach reflects a broader surge in financially-motivated attacks against cryptocurrency payment infrastructure. As digital asset adoption grows among merchants and fintechs, self-hosted payment processors represent high-value, under-monitored targets. Threat actors are increasingly weaponizing known CVEs against open-source stacks where patch cadence is inconsistent and egress controls are minimal.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
VOLTA Infostealer: How AI-Powered Malware Is Automating Victim Monetization in 2026
VOLTA Infostealer: How AI-Powered Malware Is Automating Victim Monetization in 2026
Financial Services1 week ago

VOLTA Infostealer: How AI-Powered Malware Is Automating Victim Monetization in 2026

In November 2026, Cisco Talos researchers disclosed VOLTA-AUTODOXER (VOLTA), a novel Windows infostealer that harvests credentials, cookies, payment cards, cryptocurrency seeds, OAuth tokens, SSH keys, and session data from compromised endpoints. What distinguishes VOLTA from commodity stealers is its embedded AI triage layer: stolen data is serialized into a structured evidence bundle and routed through OpenRouter to Anthropic Claude Opus 4.6, with fallbacks to Moonshot AI Kimi K2 and Google Gemini 2.5 Flash. The AI generates a monetization-ranked dossier and victim OPSEC assessment, then exfiltrates all output to a Telegram channel across three staged drops, effectively automating the analyst function for low-sophistication threat operators. VOLTA signals a structural shift in the infostealer economy: generative AI is no longer a research curiosity but an operationalized feature in commoditized malware builders. As adversarial GenAI adoption accelerates, security teams face a narrowing detection window because AI-assisted triage collapses the offline processing delay that historically gave defenders time to act after initial compromise.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports