✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
Global Operation Dismantles Tycoon2FA Phishing Platform
In March 2026, a coordinated international operation led by Europol and Microsoft successfully dismantled Tycoon2FA, a prominent phishing-as-a-service (PhaaS) platform active since August 2023. Tycoon2FA enabled cybercriminals to bypass multi-factor authentication (MFA) by intercepting live authentication sessions, capturing credentials, one-time passcodes, and session cookies in real time. This service was responsible for tens of millions of phishing emails each month, targeting over 500,000 organizations globally, including schools, hospitals, and public institutions. The takedown involved seizing 330 domains that formed the platform's core infrastructure, significantly disrupting its operations and mitigating further harm. ([blogs.microsoft.com](https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/?utm_source=openai)) The dismantling of Tycoon2FA underscores the evolving sophistication of cyber threats, particularly the commoditization of tools that facilitate large-scale MFA bypass attacks. This incident highlights the critical need for organizations to adopt phishing-resistant authentication mechanisms and enhance their cybersecurity posture to defend against such advanced threats. ([newsroom.trendmicro.com](https://newsroom.trendmicro.com/2026-03-04-TrendAI-TM-Helps-Drive-Global-Takedown-of-Tycoon-2FA-MFA-Bypass-Phishing-Service?utm_source=openai))
4 months ago
Kill Chain
2025 Mobile Malware Surge: Key Threats and Protective Measures
In 2025, Kaspersky's analysis revealed a significant surge in mobile malware attacks, with over 14 million incidents involving malicious, advertising, or unwanted software targeting mobile devices. Notably, adware constituted 62% of these detections, while the number of new Trojan banker installation packages for Android escalated to 255,090, marking a 271% increase from the previous year. This sharp rise underscores the growing profitability of such attacks for cybercriminals. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/the-number-of-trojan-banker-attacks-on-smartphones-increased-by-56-in-2025?utm_source=openai)) The proliferation of preinstalled backdoors like Triada and Keenadu, embedded during device manufacturing, presents a formidable challenge, granting attackers extensive control over compromised devices. Additionally, the emergence of the Kimwolf IoT botnet, which exploits Android TV boxes for DDoS attacks and as reverse proxies, highlights the expanding threat landscape. These developments necessitate heightened vigilance and robust security measures to safeguard mobile users. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/the-number-of-trojan-banker-attacks-on-smartphones-increased-by-56-in-2025?utm_source=openai))
4 months ago
Kill Chain
INTERPOL's Operation Sentinel: A Landmark Cybercrime Crackdown in Africa
Between October 27 and November 27, 2025, INTERPOL coordinated Operation Sentinel, a significant cybercrime crackdown across 19 African countries. The operation led to the arrest of 574 suspects involved in business email compromise (BEC), digital extortion, and ransomware attacks. Authorities dismantled over 6,000 malicious links, decrypted six ransomware variants, and recovered approximately USD 3 million. The cases investigated were linked to estimated financial losses exceeding USD 21 million. Notable incidents included a thwarted USD 7.9 million BEC attempt targeting a petroleum company in Senegal and a ransomware attack in Ghana that encrypted 100 terabytes of data, with nearly 30 terabytes successfully recovered. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai)) This operation underscores the escalating threat of cybercrime in Africa, with online offenses now accounting for a significant proportion of all crimes in many regions. The success of Operation Sentinel highlights the effectiveness of international collaboration in combating cyber-related offenses and the critical need for continued vigilance and cooperation to protect critical infrastructure and sensitive data. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai))
4 months ago
Kill Chain
Starkiller Phishing Kit: A New Era of MFA Bypass Attacks
In early 2026, cybersecurity researchers uncovered 'Starkiller,' a sophisticated phishing-as-a-service (PhaaS) platform developed by the cybercrime group Jinkusu. Unlike traditional phishing kits that rely on static HTML clones, Starkiller employs a headless Chrome browser within a Docker container to proxy legitimate login pages in real-time. This adversary-in-the-middle (AiTM) approach allows attackers to intercept user credentials and session tokens, effectively bypassing multi-factor authentication (MFA) mechanisms. The platform's user-friendly control panel enables even low-skilled cybercriminals to launch advanced phishing campaigns, posing a significant threat to organizations relying solely on conventional MFA for security. ([abnormal.ai](https://abnormal.ai/blog/starkiller-phishing-kit?utm_source=openai)) The emergence of Starkiller underscores a critical shift in the cyber threat landscape, highlighting the limitations of traditional MFA solutions against evolving phishing techniques. Organizations must adopt phishing-resistant authentication methods, such as FIDO2/WebAuthn-based hardware security keys, and implement continuous monitoring for anomalous session behaviors to mitigate the risks posed by such advanced phishing platforms. ([bytearchitect.io](https://bytearchitect.io/network-security/Starkiller-Phishing-Kit-Why-MFA-Fails-Against-Real-Time-Reverse-Proxies/?utm_source=openai))
4 months ago
Kill Chain
Project Compass: Unveiling the Arrests in 'The Com' Cybercrime Network
In January 2025, Europol initiated Project Compass, a coordinated international operation targeting 'The Com,' a decentralized cybercriminal collective known for engaging in ransomware attacks, financial extortion, and the exploitation of minors. Over the course of the year, the operation led to the arrest of 30 individuals and the identification of 179 additional suspects across 28 countries. Investigators also identified 62 victims, with four being directly safeguarded from further harm. 'The Com' primarily consists of English-speaking individuals aged 16 to 25, who utilize social media platforms, messaging applications, and online gaming environments to recruit and exploit young people. The group's decentralized structure and use of various online platforms have made it particularly challenging for law enforcement to disrupt their activities. The success of Project Compass underscores the importance of international collaboration in combating cybercrime and highlights the ongoing threat posed by such decentralized networks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/27/europol-the-com-network-arrests/?utm_source=openai)) The significance of this operation is underscored by the increasing prevalence of cybercriminal groups targeting vulnerable populations through online platforms. The arrest of key members of 'The Com' serves as a critical reminder of the need for continuous vigilance and proactive measures to protect minors from online exploitation. Additionally, the operation highlights the evolving tactics of cybercriminals, who are increasingly leveraging decentralized networks and social engineering techniques to perpetrate their crimes. ([darkreading.com](https://www.darkreading.com/threat-intelligence/30-alleged-members-the-com-arrested-project-compass/?utm_source=openai))
4 months ago
Kill Chain
IBM Bob's 2026 Prompt Injection Vulnerability Exposes AI Security Risks
In January 2026, security researchers at Prompt Armor identified a critical vulnerability in IBM's generative AI tool, Bob, which was in its beta phase. The flaw allowed for indirect prompt injection attacks, enabling malicious actors to embed hidden commands within emails or calendar entries. When Bob processed these inputs, it could be manipulated to perform unauthorized actions such as data exfiltration, malware execution, or establishing persistent system access. This vulnerability was particularly concerning due to Bob's integration capabilities with other applications, amplifying the potential attack surface. The incident underscores the inherent risks associated with AI systems that process untrusted data sources. As AI tools become more integrated into business workflows, the potential for such vulnerabilities increases, highlighting the need for robust security measures. Organizations must prioritize the development and implementation of safeguards to prevent prompt injection attacks and ensure the secure deployment of AI technologies.
4 months ago
Kill Chain
Deepfake Injection Attacks: A Growing Threat to Identity Verification in 2025
In 2025, the financial sector faced a significant surge in deepfake and injection attacks targeting identity verification processes. Fraudsters utilized AI-generated media to impersonate individuals during onboarding and authentication, leading to unauthorized access and substantial financial losses. Notably, a multinational firm in Singapore was nearly defrauded of $500,000 when attackers used deepfake video avatars to impersonate company executives during a Zoom call. ([regulaforensics.com](https://regulaforensics.com/blog/identity-verification-incidents-2025/?utm_source=openai)) This incident underscores the escalating threat posed by deepfake technologies in compromising identity verification systems. The increasing sophistication and accessibility of AI tools have enabled attackers to bypass traditional security measures, highlighting the urgent need for enhanced detection and prevention strategies.
4 months ago
Kill Chain
AI-Assisted Cyberattack Compromises 600+ FortiGate Firewalls Globally
Between January 11 and February 18, 2026, a Russian-speaking threat actor utilized commercial generative AI tools to compromise over 600 Fortinet FortiGate firewalls across 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking two-factor authentication, without leveraging any specific software vulnerabilities. Once access was gained, AI-generated scripts were employed to extract and decrypt sensitive data, including SSL-VPN credentials, administrative passwords, and network configurations. This information facilitated further network infiltration and reconnaissance activities. ([cybernews.com](https://cybernews.com/security/threat-actor-ai-tools-claude-fortinet-fortigate/?utm_source=openai)) This incident underscores the evolving threat landscape where AI tools enable even low-skilled attackers to execute large-scale, sophisticated cyberattacks. Organizations must reassess their security postures, emphasizing the importance of robust authentication mechanisms and the need to secure management interfaces against unauthorized access.
4 months ago
Kill Chain
QuickLens Chrome Extension Compromised: A Cautionary Tale for Browser Security
In February 2026, the 'QuickLens - Search Screen with Google Lens' Chrome extension, initially a legitimate tool with approximately 7,000 users, was compromised following a change in ownership. The new version 5.8 introduced malicious scripts that stripped browser security headers and executed arbitrary JavaScript, enabling the theft of cryptocurrency wallets and sensitive user data. This incident underscores the risks associated with browser extensions, particularly those that undergo ownership changes, and highlights the need for vigilant monitoring of software supply chains to prevent similar attacks.
4 months ago
Kill Chain
AI-Powered Fake ID Operation Dismantled: Ukrainian Operator Pleads Guilty
In February 2026, Ukrainian national Yurii Nazarenko pleaded guilty to operating OnlyFake, an AI-driven website that generated and sold over 10,000 counterfeit identification documents globally. The platform allowed users to create realistic digital versions of passports, driver's licenses, and Social Security cards, which were primarily used to bypass Know Your Customer (KYC) verification processes at financial institutions and cryptocurrency exchanges. Nazarenko was extradited from Romania in September 2025, agreed to forfeit $1.2 million, and faces a maximum sentence of 15 years in prison, with sentencing scheduled for June 26, 2026. This case underscores the growing misuse of artificial intelligence in facilitating sophisticated cybercrimes, particularly in identity fraud. The incident highlights the urgent need for enhanced security measures and regulatory frameworks to address AI-powered threats in the digital landscape.
4 months ago
Kill Chain
DoJ Seizes $61 Million in Tether Linked to Pig Butchering Crypto Scams
In February 2026, the U.S. Department of Justice (DoJ) seized over $61 million in Tether (USDT) linked to 'pig butchering' cryptocurrency scams. These schemes involved fraudsters building trust with victims through fake romantic relationships, then persuading them to invest in fraudulent cryptocurrency platforms that displayed fabricated high returns. When victims attempted to withdraw funds, they were met with demands for additional fees, leading to further financial loss. The seized funds were traced to cryptocurrency addresses used to launder proceeds from these scams. ([justice.gov](https://www.justice.gov/usao-ednc/pr/us-attorneys-office-ednc-announces-seizure-61-million-dollars-worth-cryptocurrency?utm_source=openai)) This incident underscores the growing prevalence of sophisticated social engineering tactics in financial fraud, particularly within the cryptocurrency sector. It highlights the need for increased vigilance and regulatory measures to protect individuals from such deceptive practices.
4 months ago
Kill Chain
Cisco SD-WAN Zero-Day Exploited Since 2023
In February 2026, Cisco disclosed a critical zero-day vulnerability (CVE-2026-20127) in its Catalyst SD-WAN Controller and Manager, which had been actively exploited since at least 2023. The flaw allowed unauthenticated remote attackers to bypass authentication mechanisms, granting them high-privileged access to manipulate network configurations via the NETCONF protocol. This exploitation enabled the addition of rogue peers and potential disruption of network operations. ([thehackernews.com](https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html?utm_source=openai)) The incident underscores the persistent targeting of network infrastructure by sophisticated threat actors, emphasizing the need for organizations to prioritize timely patching and robust security measures to protect critical systems. ([thehackernews.com](https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html?utm_source=openai))
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports