✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
INTERPOL's Operation Ramz: A Major Cybercrime Crackdown in the MENA Region
Between October 2025 and February 2026, INTERPOL coordinated Operation Ramz, a large-scale cybercrime crackdown across 13 Middle Eastern and North African countries. The operation led to the arrest of 201 individuals and the identification of 382 additional suspects involved in phishing, malware distribution, and online fraud. Authorities seized 53 servers and identified 3,867 victims, disrupting significant malicious infrastructure and preventing further cyber threats. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) This operation underscores the escalating threat of cybercrime in the MENA region and highlights the effectiveness of international collaboration in combating such activities. The involvement of private cybersecurity firms like Kaspersky and Group-IB demonstrates the critical role of public-private partnerships in enhancing global cybersecurity efforts. ([kaspersky.co.za](https://www.kaspersky.co.za/about/press-releases/kaspersky-supports-interpols-operation-ramz-in-mena-region-resulting-in-over-200-arrests?utm_source=openai))
2 months ago
Kill Chain
INTERPOL's Operation Ramz: A Landmark Cybercrime Crackdown in MENA
Between October 2025 and February 2026, INTERPOL coordinated Operation Ramz, a significant cybercrime crackdown across 13 Middle East and North Africa (MENA) countries. This operation led to the arrest of 201 individuals and the identification of 382 additional suspects involved in various cybercrimes, including phishing, malware distribution, and financial fraud. Authorities seized 53 servers and identified 3,867 victims, highlighting the extensive impact of these cybercriminal activities. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) The success of Operation Ramz underscores the effectiveness of international collaboration in combating cybercrime. As cyber threats continue to evolve and proliferate, such coordinated efforts are crucial in disrupting malicious networks and protecting potential victims from emerging cyber scams and attacks.
2 months ago
Kill Chain
Mamont Banking Trojan: A Rising Threat in Q1 2026
In Q1 2026, the Mamont banking Trojan emerged as a significant threat to Android users, accounting for 73.5% of banking Trojan detections. This malware family, including variants like Mamont.jo and Mamont.jx, primarily targets users' financial credentials by masquerading as legitimate applications. The surge in Mamont-related incidents underscores the evolving tactics of cybercriminals in exploiting mobile platforms for financial gain. The proliferation of Mamont banking Trojans highlights the critical need for enhanced mobile security measures. As cyber threats become more sophisticated, users and organizations must adopt proactive strategies to safeguard sensitive financial information from such pervasive malware.
2 months ago
Kill Chain
MiniPlasma Zero-Day: A Critical Threat to Windows 11 Security
In May 2026, security researcher Chaotic Eclipse disclosed a critical zero-day vulnerability in Microsoft Windows, codenamed MiniPlasma. This flaw affects the Windows Cloud Files Mini Filter Driver (cldflt.sys) and allows attackers to escalate privileges to SYSTEM level on fully patched Windows 11 systems. The vulnerability was initially reported to Microsoft in September 2020 and was believed to have been patched in December 2020 as CVE-2020-17103. However, recent findings indicate that the issue remains unpatched, posing significant security risks. The public release of the MiniPlasma exploit underscores ongoing challenges in Windows security, particularly concerning privilege escalation vulnerabilities. Organizations must reassess their security postures and implement additional measures to mitigate the risks associated with this unpatched flaw.
2 months ago
Kill Chain
Mini Shai-Hulud Attack: A Wake-Up Call for Developer Ecosystem Security
Between April 29 and May 1, 2026, a coordinated supply chain attack known as "Mini Shai-Hulud" targeted multiple developer ecosystems, including npm, PyPI, and Docker Hub. The threat actor group TeamPCP injected malicious code into widely used packages such as SAP's Cloud Application Programming Model, PyTorch Lightning, and Intercom's npm package. This malware harvested sensitive credentials from developer environments and CI/CD pipelines, including GitHub tokens, cloud API keys, and SSH keys, by exfiltrating them to attacker-controlled repositories. The attack compromised over 170 packages, affecting millions of developers and organizations worldwide. ([labs.cloudsecurityalliance.org](https://labs.cloudsecurityalliance.org/research/csa-research-note-mini-shai-hulud-supply-chain-20260503-csa/?utm_source=openai)) This incident underscores the evolving nature of supply chain attacks, which now focus on developer workstations as entry points. The integration of malicious code into trusted packages highlights the need for enhanced security measures in the software development lifecycle, particularly in dependency management and CI/CD processes. Organizations must adopt comprehensive strategies to protect against such sophisticated threats.
2 months ago
Kill Chain
Windows 'MiniPlasma' Zero-Day Exploit Grants SYSTEM Access
On May 17, 2026, cybersecurity researcher Chaotic Eclipse released a proof-of-concept exploit named 'MiniPlasma' that enables attackers to gain SYSTEM privileges on fully patched Windows systems. This exploit targets a vulnerability in the 'cldflt.sys' Cloud Filter driver, specifically the 'HsmOsBlockPlaceholderAccess' routine, which was initially reported in 2020 as CVE-2020-17103 and believed to have been patched in December 2020. However, the researcher discovered that the vulnerability remains exploitable, allowing for privilege escalation attacks. The release of this exploit underscores the critical importance of thorough patch validation and continuous security assessments. Organizations must remain vigilant, as previously addressed vulnerabilities can resurface, posing significant security risks. This incident highlights the necessity for robust vulnerability management practices to ensure the effectiveness of security patches.
2 months ago
Kill Chain
Alleged Dream Market Administrator Indicted for Money Laundering
In May 2026, Owe Martin Andresen, the alleged main administrator of the defunct darknet marketplace Dream Market, was indicted in the United States on multiple counts of money laundering. Andresen, known by the alias "Speedstepper," is accused of accessing dormant cryptocurrency wallets containing millions of dollars in commission payments from Dream Market, which operated from 2013 until its shutdown in 2019. He allegedly transferred these funds into new cryptocurrency wallets and converted them into gold bars, directing shipments to his residence in Germany. German authorities arrested Andresen on May 7, 2026, under separate charges of concealment money laundering. ([justice.gov](https://www.justice.gov/usao-ndga/pr/german-citizen-charged-laundering-funds-linked-prominent-darknet-marketplace-dream?utm_source=openai)) This case underscores the persistent challenges law enforcement faces in tracking and prosecuting cybercriminals who exploit digital currencies and anonymized platforms to launder illicit proceeds. The indictment highlights the importance of international cooperation in addressing cybercrime and the evolving tactics used by threat actors to obfuscate their activities.
2 months ago
Kill Chain
Understanding the Risks: AI Integration and Cloud Security
In 2025, the enterprise risk landscape experienced a paradigm shift: the adoption of AI and LLMs officially becoming the primary driver of cloud risk. Today, almost 88% of organizations now leverage AI in at least one business function. With this level of integration, the risk of AI is now outpacing traditional security guardrails, culminating in a highly complex and interconnected attack surface. SentinelOne’s new AI and Cloud Verified Exploit Paths and Secrets Scanning Report examines this evolving threatscape and draws on telemetry from over 11,000 anonymized customer environments to offer deeper visibility into how threat actors are actively exploiting modern cloud and AI infrastructures. A primary finding of the 2026 report is the rising proliferation of AI-specific credentials. The data indicates that AI-related secrets — such as OpenAI API Keys, Azure OpenAI API Keys, and others — increased by approximately 140% in a span of one year. This growth correlates directly with the rapid embedding of AI technologies into customer support systems, internal tooling, financial platforms, and product experiences. Ubiquitous deployment has generated a widespread organizational pattern known as 'shadow AI' – the unsanctioned use of AI tools in an environment without formal IT approval or security oversight. In practice, this occurs when developers or internal teams utilize unmanaged or personal LLM keys to process corporate data outside of sanctioned IT or security channels. Since these AI integrations span numerous internal applications, the same API keys are frequently duplicated and stored within code repositories, SaaS configurations, and development scripts. Compounding this, these credentials are often implemented without proper access controls or routine rotation schedules. The sprawl of these credentials renders them difficult to track via standard secrets management protocols, establishing a requirement for more centralized governance over how AI keys are issued and utilized.
2 months ago
Kill Chain
AI-Assisted Zero-Day Exploit: A New Era in Cyber Threats
In May 2026, Google's Threat Intelligence Group identified the first documented instance of cybercriminals utilizing artificial intelligence to develop a zero-day exploit. The attackers employed AI to discover a flaw in a Python script, enabling them to bypass two-factor authentication on a widely-used open-source system. The exploit code exhibited characteristics indicative of AI assistance, such as explanatory comments and an invented severity rating. This incident underscores a significant shift in cyber threat dynamics, as AI begins to play an active role in enhancing the capabilities of cyberattacks. The discovery highlights the growing reliance of both state-sponsored and criminal cyber threat actors on AI across various stages of attack, from exploit development to social engineering. As AI models become increasingly adept at uncovering subtle software vulnerabilities, the cybersecurity landscape faces new challenges in defending against these sophisticated, AI-driven threats.
2 months ago
Kill Chain
Critical Windows Zero-Day Vulnerabilities: YellowKey and GreenPlasma Exposed
In May 2026, cybersecurity researcher Chaotic Eclipse disclosed two critical zero-day vulnerabilities in Microsoft Windows: YellowKey and GreenPlasma. YellowKey allows attackers with physical access to bypass BitLocker encryption on Windows 11 and Windows Server 2022/2025 systems by exploiting the Windows Recovery Environment (WinRE). GreenPlasma is a privilege escalation flaw that enables unprivileged users to gain SYSTEM-level access by manipulating the CTFMON process. Both vulnerabilities were publicly disclosed due to the researcher's dissatisfaction with Microsoft's handling of bug reports. The public release of these exploits underscores the ongoing challenges in securing widely used encryption and privilege management systems. Organizations must reassess their reliance on BitLocker for data protection and implement additional security measures to mitigate the risks posed by these vulnerabilities.
2 months ago
Kill Chain
TrickMo's Evolution: Leveraging TON for Enhanced Stealth in Banking Malware
In early 2026, a new variant of the TrickMo Android banking trojan emerged, leveraging The Open Network (TON) for command-and-control (C2) communications. This variant, observed by ThreatFabric between January and February 2026, actively targeted banking and cryptocurrency wallet users in France, Italy, and Austria. By utilizing TON's decentralized infrastructure, the malware effectively evaded traditional domain takedown efforts, complicating mitigation strategies. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/trickmo-c-ton-network-android/?utm_source=openai)) The adoption of TON for C2 communications signifies a broader trend among threat actors toward decentralized platforms to enhance stealth and resilience. This evolution underscores the need for security teams to adapt detection and response strategies to address threats that exploit decentralized networks. ([securityaffairs.com](https://securityaffairs.com/192003/malware/android-banking-trojan-trickmo-evolves-using-ton-network-for-c2.html?utm_source=openai))
2 months ago
Kill Chain
TrickMo Android Banker Leverages TON Blockchain for Covert Operations
In May 2026, a new variant of the TrickMo Android banking malware emerged, targeting users in France, Italy, and Austria. Disguised as popular apps like TikTok and streaming services, this malware employs The Open Network (TON) blockchain for covert command-and-control communications, enhancing its stealth and resilience. TrickMo's capabilities include intercepting one-time passwords (OTPs), recording screens, exfiltrating data, and executing overlay attacks to steal banking credentials. The malware's use of TON's decentralized infrastructure complicates detection and mitigation efforts. This incident underscores a growing trend of cybercriminals leveraging decentralized technologies to evade traditional security measures. The adoption of blockchain for malicious communications highlights the need for advanced detection strategies and reinforces the importance of user vigilance against social engineering tactics.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports