✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
Chrome Attacked: 2025 Zero-Day Memory Exploit in ANGLE Library Exposed
In December 2025, Google disclosed a high-severity zero-day vulnerability (CVE-2025-14174) affecting its Chrome browser, which had been exploited in the wild. The flaw, residing in Chrome's Almost Native Graphics Layer Engine (ANGLE), allowed attackers to perform out-of-bounds memory access via a crafted HTML page, enabling memory corruption, crashes, or remote code execution. Discovered by Apple's Security Engineering and Google TAG teams, this vulnerability triggered urgent patching across all Chromium-based browsers, as the exploit was independently observed targeting users prior to public awareness. This incident underscores growing risks associated with memory management flaws in popular software and the increasing frequency of zero-day exploits. With regulatory bodies like CISA flagging exploited Chrome vulnerabilities for immediate remediation, the event highlights a rising trend of sophisticated, targeted browser attacks that demand rapid and coordinated enterprise response.
6 months ago
Kill Chain
CISA & MITRE Unveil 2025 CWE Top 25: The Most Dangerous Software Weaknesses
On December 11, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) and MITRE's HSSEDI jointly released the 2025 CWE Top 25 Most Dangerous Software Weaknesses advisory. This annual compilation highlights the most critical security flaws that are routinely exploited by adversaries to gain unauthorized access, exfiltrate sensitive data, or disrupt operations. The advisory urges software vendors, developers, and enterprise security teams to integrate the Top 25 into their vulnerability management, procurement, and secure development practices, as the listed weaknesses are a leading cause of breaches and operational disruptions sector-wide. The 2025 iteration of the list arrives amid a surge in high-profile breaches linked to software supply chain vulnerabilities and regulatory pressure for Secure by Design practices. Organizations that fail to address these prevalent weaknesses remain at heightened risk of data compromise, operational downtime, and non-compliance with modern security frameworks.
6 months ago
Kill Chain
Spiderman Phishing Service: A 2024 Wakeup Call for European Banks
In early 2024, a sophisticated phishing-as-a-service platform known as Spiderman emerged, targeting customers of more than 50 European banks and cryptocurrency holders. The perpetrators leveraged pixel-perfect cloned websites and credential harvesting techniques to deceive users into divulging sensitive financial information. Attackers used advanced phishing kits capable of bypassing two-factor authentication and dynamically generating legitimate-looking web pages, resulting in significant financial losses and heightened concern among European financial institutions. This incident underscores a growing trend of increasingly accessible and effective phishing services, enabling even low-skill cybercriminals to launch large-scale, targeted attacks. Regulatory scrutiny and the evolving threat landscape demand that organizations bolster defenses against phishing service operations leveraging social engineering and real-time site cloning.
6 months ago
Kill Chain
US Treasury Highlights $4.5B in Ransomware Payments: 2024 Threat Landscape
In February 2024, the US Treasury’s Financial Crimes Enforcement Network (FinCEN) reported that ransomware attacks have resulted in over $4.5 billion in ransom payments since 2013, underscoring a dramatic surge in both scale and sophistication. Attackers typically infiltrated organizations through phishing campaigns, exploitation of unpatched vulnerabilities, and compromised remote desktop protocols, deploying ransomware variants to encrypt data and demand payment. These incidents disrupted critical business operations across sectors, forced enterprises to halt services, and left many struggling with reputational and financial damage. This report is especially relevant as ransomware strains evolve, facilitating large-scale attacks on enterprises, healthcare, and infrastructure. Heightened regulatory scrutiny, such as OFAC and FinCEN advisories, means organizations face intensified pressure to monitor, report, and prevent ransomware-related activities.
6 months ago
Kill Chain
Critical Flaw in India-Based CCTV Cameras Exposes Credentials via Missing Authentication
In December 2025, a critical vulnerability (CVE-2025-13607) was discovered in multiple India-based CCTV camera systems, particularly impacting D-Link's DCS-F5614-L1 model up to version v1.03.038, with other vendors like Sparsh Securitech and Securus CCTV also implicated. The flaw allowed remote attackers to access sensitive camera configuration information and steal account credentials without any authentication, dramatically raising the risk of unauthorized surveillance, data breaches, or lateral movement across commercial facility networks. Security researchers reported this issue to CISA, who validated the high-severity risk with a CVSS v4 score of 9.3. This incident highlights the persistent risk posed by insecure IoT devices in critical sectors. Vulnerabilities in widely deployed camera models remain a prime target for opportunistic attackers and serve as a cautionary signal amidst the global increase in attacks exploiting exposed IoT endpoints.
6 months ago
Kill Chain
Wave of Android Malware Hits Polish Bank Customers—FvncBot, SeedSnatcher & ClayRat Evolve
In late 2025, security researchers from Intel 471, CYFIRMA, and Zimperium uncovered two new Android malware families—FvncBot and SeedSnatcher—alongside an upgraded ClayRat variant. FvncBot, disguised as a banking security app targeting mBank customers in Poland, used sophisticated credential theft and evasive techniques to breach users’ devices, while SeedSnatcher enabled wide-scale stealth data exfiltration. ClayRat, already known in cybercriminal circles, has evolved to feature enhanced capabilities for data theft and persistence. These malware strains are distributed through phishing campaigns and malicious app stores targeting finance sector customers and exploiting gaps in mobile device controls and user awareness. The campaigns resulted in substantial risk of unauthorized transactions, identity theft, and broader exposure of banking and personal data. The coordinated discovery highlights a dramatic escalation in the capabilities of mobile-targeted malware, especially those aimed at financial institutions in Eastern Europe. The incident exemplifies the rapid, continuous innovation by threat actors seeking to monetize weaknesses in endpoint security and exploit unsuspecting app users, raising the urgency for organizations to modernize mobile and app-layer security postures.
6 months ago
Kill Chain
GoldFactory Trojan Infects 11,000+ Mobile Users in Southeast Asia through Fake Banking Apps
Between October and December 2024, a financially motivated threat group known as GoldFactory orchestrated an extensive campaign targeting mobile users across Indonesia, Thailand, and Vietnam. By impersonating trusted government services, the attackers distributed modified Android banking apps laced with malware, resulting in over 11,000 infections. Once installed, these malicious applications harvested sensitive financial data and enabled unauthorized transactions, posing significant financial risks to individual users and undermining trust in mobile banking channels. The campaign used phishing techniques and social engineering, making detection challenging for average users. This incident illustrates the growing trend of cybercriminals leveraging mobile channels and government impersonation to amplify reach and lower the barrier for monetization in emerging markets. It also highlights the urgent need for stronger mobile security controls, user education, and regulatory vigilance to mitigate evolving threats targeting digital financial services.
6 months ago
Kill Chain
Marquis Data Breach: 2024 Supply Chain Attack Exposes US Banking Customers
In early 2024, Marquis Software Solutions, a financial marketing service provider, was the victim of a significant data breach that compromised sensitive personal information across more than 74 US banks and credit unions. The attackers gained unauthorized access through a third-party vulnerability and exfiltrated data sets containing names, addresses, Social Security numbers, financial account details, and demographic information of hundreds of thousands of customers. The breach not only impacted Marquis’s direct clients but also exposed downstream institutions and their end-users, triggering regulatory notifications and potential reputational damage to affected financial entities. This incident highlights the enduring risk posed by supply chain vulnerabilities within highly regulated industries, as attackers continue targeting trusted vendors with access to sensitive data. It underscores increasing regulatory scrutiny on vendor risk management and data protection, especially within financial and healthcare sectors.
6 months ago
Kill Chain
Brazil Faces 2025 Banking Trojan Crisis Spread via WhatsApp and NFC Relay Fraud
In late 2025, Brazil was struck by a sophisticated banking trojan campaign perpetrated by the threat actor Water Saci. Leveraging WhatsApp as a wormable transmission channel, attackers delivered highly obfuscated HTA and PDF payloads to users. Once opened, these files initiated a new Python-based trojan variant, enabling credential theft and fraudulent banking transactions. The attack chain also included NFC relay tactics (RelayNFC), amplifying transactional fraud by hijacking contactless payment operations. The campaign evaded detection using advanced scripting and lateral propagation, causing financial and reputational damage within the Brazilian financial sector. This incident marks a significant escalation in multichannel malware delivery, combining social engineering, banking trojans, and NFC payment interception. It underscores the converging risk between consumer messaging apps and new payment technologies, highlighting the urgency for layered east-west and egress network protection.
6 months ago
Kill Chain
Google 2025 Android Zero-Day Attacks: Lessons on Mobile Vulnerability Exploitation
In December 2025, Google disclosed that it had patched 107 Android vulnerabilities, including two zero-day flaws exploited in active attacks. These zero-days, tracked as CVE-2025-23027 (privilege escalation in the System component) and CVE-2025-23028 (in the Kernel), were weaponized by threat actors to target select Android devices, likely via malicious apps or tailored exploits. Google's rapid response involved issuing security updates through its December Android Security Bulletin, minimizing the attack surface and urging device manufacturers and users to deploy patches immediately. The incident highlights the ongoing challenges of mobile platform security and the rapid exploitation of unknown flaws by attackers. This event is emblematic of the rise in advanced mobile vulnerability exploitation, where threat actors seek to bypass native OS security and target sensitive mobile endpoints. With the prevalence of bring-your-own-device (BYOD) policies and increasing mobile workforce reliance, timely patching and comprehensive visibility are more crucial than ever to defending against agile, targeted attackers.
6 months ago
Kill Chain
Google Fixes 107 Android Vulnerabilities, Including 2 Exploited in the Wild
In June 2025, Google released a critical Android security update addressing 107 vulnerabilities across multiple subsystems, including Framework, System, and third-party vendor components such as Arm, MediaTek, and Qualcomm. Notably, two high-severity Framework vulnerabilities had been exploited in the wild prior to the patch, allowing attackers to potentially bypass defenses, execute code, or gain unauthorized access on unpatched devices. Attackers leveraged these flaws to target unsuspecting Android users before Google issued its advisory and fix, putting millions of devices at risk until users updated their software. This incident highlights the ongoing risk posed by zero-day vulnerabilities in widely used mobile platforms and the rapidity with which sophisticated threat actors exploit unpatched systems. The urgency of timely patching is reinforced, as targeted attacks on mobile users remain an attractive vector for cybercriminals and APT groups alike.
6 months ago
Kill Chain
Law Enforcement Dismantles Cryptomixer, Deals Major Blow to Ransomware Laundering Networks
In June 2024, a coalition of European law enforcement agencies successfully disrupted Cryptomixer, a cryptocurrency mixing service allegedly used to launder proceeds from ransomware and cybercrime. Authorities seized infrastructure and millions in digital assets linked to illicit transactions, following months of cross-border investigation and digital forensics. Cryptomixer was reportedly favored by ransomware groups to obfuscate the trail of stolen funds, complicating recovery efforts and hampering international financial tracking of illicit operations. This incident underscores the escalation of law enforcement action against cryptographic financial laundering tools, which remain instrumental to cybercriminal operations. Increasing scrutiny and regulatory collaboration highlight a growing intolerance for shadow financial ecosystems enabling ransomware and cyber extortion.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports