✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
Punycode Phishing: How IDN Abuse Enabled Stealth Attacks in 2026
In January 2026, security researchers identified a surge in phishing attacks leveraging Internationalized Domain Names (IDNs) encoded with Punycode, enabling attackers to create visually deceptive domains that closely resemble legitimate ones. By substituting standard ASCII characters with similar-looking Unicode characters, threat actors bypassed traditional detection, tricking users into visiting fraudulent sites and unknowingly exposing credentials or sensitive information. The attack was uncovered through DNS log analysis, revealing repeated internal access attempts to encoded domains such as xn--yutube-wqf.com, demonstrating the sophistication and stealth of this social engineering tactic. This incident highlights the growing prevalence of advanced phishing campaigns using homoglyph attacks and encoded domains, underscoring the need for updated detection routines and user awareness. Organizations face increased operational risk as threat actors exploit gaps caused by internationalization and encoding, making timely monitoring and DNS log analysis crucial.
6 months ago
Kill Chain
Predator Bots Hit APIs at Scale: Are Your Defenses Ready for Autonomous Threats?
In 2024, a surge in highly sophisticated "predator bots" led to a large-scale wave of automated attacks targeting critical APIs across multiple industries. Threat actors leveraged AI-driven automation to mimic human behavior and evade detection, resulting in credential theft, fraudulent transactions, account takeovers, and widespread data scraping. The attacks exploited shadow APIs and business logic flaws, bypassed traditional defenses like IP filtering and CAPTCHAs, and drained significant revenue through scalping and abuse. The economic impact has been severe, with business losses estimated in the billions, and operational teams scrambling to regain visibility and control. This incident highlights the urgent need for modern, adaptive security that operates at machine speed. As attackers weaponize automation and AI, organizations face mounting pressure to implement layered defenses, proactive anomaly detection, and API-centric protection to prevent sophisticated fraud, data loss, and erosion of customer trust.
6 months ago
Kill Chain
How PDFSider Malware Enabled a Major Fortune 100 Ransomware Breach in Finance
In January 2026, a Fortune 100 financial services company was compromised by a ransomware group utilizing a sophisticated new Windows malware strain dubbed PDFSider. Attackers used social engineering, posing as support staff to trick employees into running malicious files and installing remote-access tools. The payload was delivered via spearphishing emails containing a ZIP archive with a legitimate, signed PDF24 Creator executable and an altered cryptbase.dll, exploiting DLL side-loading to bypass security controls. Once activated, PDFSider established a covert backdoor, loaded its code into memory, and exfiltrated system information over encrypted DNS channels, employing advanced evasion and anti-analysis tactics to maintain persistent access and enable ransomware deployment. This incident underscores a surge in targeted ransomware and espionage-style operations, where attackers blend APT tradecraft with financial motives. As threats increasingly leverage trusted tools, memory-resident malware, and advanced encryption, organizations face mounting pressure to bolster detection and containment strategies in response to evolving attacker sophistication.
6 months ago
Kill Chain
StackWarp: AMD’s Hardware Flaw Exposes Confidential Cloud VMs to Attack
In January 2026, researchers disclosed a vulnerability called StackWarp, affecting AMD’s Zen 1 through Zen 5 processor lines, including EPYC models widely used in cloud and enterprise environments. The flaw (CVE-2025-29943) enables privileged threat actors on host servers to manipulate the stack pointer of guest memory in confidential virtual machines (CVMs) secured with AMD SEV-SNP. By exploiting a previously undocumented control bit, attackers can redirect program flow inside targeted VMs, leading to remote code execution, privilege escalation, and exposure of sensitive assets such as cryptographic keys or kernel privileges. AMD published mitigations and microcode updates in July and October 2025, with additional firmware patches pending. This incident is a compelling example of the persistent risks stemming from microarchitectural attacks bypassing virtualization and memory encryption boundaries. As supply chain, multi-tenant cloud, and confidential computing adoption increases, organizations should regularly assess hardware-layer exposures and stay current on firmware updates to limit high-impact cascades.
6 months ago
Kill Chain
DoS Flaw in Palo Alto Networks PAN-OS 2026: Firewall Shutdowns Expose New Risks
In January 2026, Palo Alto Networks disclosed and patched a high-severity Denial of Service (DoS) vulnerability—CVE-2026-0227—in its next-generation firewalls running PAN-OS 10.1 or later, as well as in Prisma Access configurations with the GlobalProtect gateway or portal enabled. The flaw allowed unauthenticated attackers to remotely disable firewall services, causing the devices to enter maintenance mode and disrupt protections. While there was no evidence of active exploitation at disclosure, the vulnerability posed significant risks to business continuity and network security, particularly for organizations relying on always-on perimeter defense. This incident is of particular concern given the recent uptick in attacks targeting network security and VPN appliances, regulatory focus on rapid patching, and the extensive use of Palo Alto hardware by Fortune 10 enterprises, critical infrastructure, and government agencies. The evolving threat landscape underscores the urgent need for timely vulnerability management and layered security controls.
6 months ago
Kill Chain
Microsoft & Law Enforcement Dismantle RedVDS Cybercrime Platform in 2026
In January 2026, Microsoft, in collaboration with U.S. and U.K. law enforcement, disrupted the RedVDS cybercrime infrastructure, dismantling a crimeware-as-a-service network that fueled millions in global fraud losses. Managed by the threat actor Storm-2470, RedVDS offered inexpensive, disposable Windows-based RDP servers with no logging, enabling cybercriminals to conduct mass phishing, business email compromise (BEC) schemes, account takeovers, and other online fraud at scale. RedVDS’s infrastructure was critical in facilitating over $40 million in reported fraud losses in the U.S. since March 2025, impacting at least 191,000 organizations across sectors like healthcare, legal, finance, manufacturing, and real estate. The incident underscores the rapidly growing risk posed by cybercrime subscription models that democratize access to sophisticated attack tools. As CaaS platforms pair with generative AI, threat actors are increasingly able to automate and scale targeted campaigns, elevating both regulatory risk and enterprise exposure across all industries.
6 months ago
Kill Chain
Microsoft Leads RedVDS Takedown: Shutting Down Cybercrime-as-a-Service in 2024
In June 2024, Microsoft, in collaboration with law enforcement agencies, successfully disrupted the notorious RedVDS cybercrime-as-a-service operation by seizing two of its primary domains. RedVDS had enabled a global network of cybercriminals to launch ransomware and data-theft attacks, facilitating millions of dollars in losses through their infrastructure. The takedown was part of an ongoing campaign targeting criminal online service providers that enable encrypted C2 traffic, lateral movement, and evasion of traditional network defenses. The operation demonstrated how threat actors are using such platforms to remain agile and scale attacks against diverse sectors worldwide. This takedown spotlights the increasing focus by law enforcement and cloud providers on dismantling illicit digital infrastructures. With cybercrime-as-a-service continuing to gain traction and lower the barrier for threat actors, addressing these platforms is pivotal to disrupting large-scale ransomware and data exfiltration campaigns.
6 months ago
Kill Chain
Spanish Police Disrupt Black Axe BEC Ring, Arresting Key Leaders in 2024 Crackdown
In early June 2024, Spanish National Police, supported by Europol and German authorities, arrested 34 individuals—among them top leaders of Black Axe, a notorious Nigerian-backed cybercrime syndicate. The tightly coordinated operation targeted Black Axe’s business email compromise (BEC) activities, which since September 2023 exploited corporate email channels to orchestrate multi-million-dollar fraud, money laundering, and shell company schemes across Europe. Authorities seized $77,000 in cash, froze $139,000 in bank accounts, and confiscated electronic devices and vehicles used for illicit activities. Black Axe’s operations were sophisticated and involved extensive networks of money mules and international laundering techniques. This disruption is highly relevant as BEC attacks grow in frequency, scale, and organizational complexity. Recent law enforcement action highlights the evolving threats posed by criminal syndicates who weaponize digital channels and exploit human and technical vulnerabilities, prompting urgent review of security controls and detection capabilities.
6 months ago
Kill Chain
Pig Butchering Fraud: Service Providers Power the Next Wave of Industrial-Scale Online Scams
In early 2026, cybersecurity researchers revealed that two specialized service providers are supplying criminal networks with infrastructure and scalable toolkits to support industrial-scale pig butchering fraud, primarily across Southeast Asia. These providers lower the barrier to entry for fraudsters by offering turnkey scam platforms, stolen identity data, and payments solutions designed to evade law enforcement. The so-called PBaaS (Pig-Butchering-as-a-Service) ecosystem enables rapid creation of scam campaigns leveraging advanced CRM platforms, phishing tactics, and laundering tools, impacting individuals and financial institutions globally. This incident underscores the evolution of cyber-enabled fraud into a scalable, service-driven shadow industry, exploiting technology and industrial organization for criminal gain. The widespread adoption of such "fraud-as-a-service" business models reflects a broader trend in cybercrime, making advanced threat tactics more accessible to a wider range of malicious actors.
6 months ago
Kill Chain
Spain’s 2026 Black Axe Bust Exposes BEC Cybercrime Risks
In January 2026, Spanish authorities arrested 34 individuals connected to the Black Axe cybercrime syndicate after dismantling a sophisticated cyber fraud ring operating across several European countries. The group, led by Nigerian nationals, specialized in Business Email Compromise (BEC) attacks and man-in-the-middle scams, intercepting legitimate corporate communications to modify payment details and siphon funds. Law enforcement seized cash, vehicles, electronics, and froze bank accounts, with total damages from the group estimated at over $6 million—$3.5 million of which is tied directly to this operation. The offenders face serious criminal charges including fraud, money laundering, and membership in a criminal organization. This case highlights both the growing scale and ongoing evolution of international BEC cybercrime, where criminal syndicates exploit business processes, global money mules, and increasingly sophisticated digital tactics. Regulatory, financial, and reputational risks remain high for organizations that fail to secure communications channels and business workflows from targeted attacks.
6 months ago
Kill Chain
Europol Arrests 34 Black Axe Members in Massive 2026 Organized Cyber-Fraud Takedown
In January 2026, Europol and Spanish authorities arrested 34 suspected members of the Black Axe organized crime syndicate in Spain, dismantling a major transnational cyber-fraud operation. The group, originating from Nigeria but operating internationally, orchestrated a series of sophisticated cyber-enabled crimes, including business email compromise, romance and inheritance scams, credit card and tax fraud, and extensive money laundering. Law enforcement seized over €185,000 ($216,000) in assets and disrupted fraud estimated at more than €5.9 million ($6.9M), highlighting Black Axe's role in global financial crime and cyber-enabled offenses. This incident underscores the growing intersection of traditional organized crime with advanced cyber-fraud tactics, as law enforcement faces increasingly complex, multi-jurisdictional threats. The reliance on cyber-enabled fraud techniques by such syndicates reflects an urgent need for organizations to adapt their security posture to address sophisticated, persistent, and highly organized threats.
6 months ago
Kill Chain
WhatsApp-Based Worm Drives Astaroth Banking Trojan Surge Across Brazil
In late 2025 and early 2026, a major cybersecurity campaign—codenamed Boto Cor-de-Rosa—targeted millions of WhatsApp users in Brazil with the Astaroth (Guildma) banking trojan. Threat actors leveraged a novel worm module written in Python that hijacked victims’ WhatsApp contact lists, automatically sending malicious ZIP files and spreading the malware with unprecedented speed. Upon execution, the ZIP archive dropped a Visual Basic script that downloaded further payloads, including a banking module capable of harvesting credentials when victims accessed online banking sites. Over 95% of reported infections occurred in Brazil, severely impacting personal and financial data security. This campaign highlights how cybercriminals are weaponizing popular messaging apps as attack vectors for financial malware, reflecting the rising sophistication and modularity of their methods. The shift to WhatsApp-based propagation, combined with multi-language modular code, signals a concerning trend for businesses and individuals in regions with high platform adoption rates.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports