✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
ARToken PhaaS Unveiled: A New Threat to Microsoft 365 Security
In July 2026, Cisco Talos researchers uncovered 'ARToken,' a phishing-as-a-service (PhaaS) platform affiliated with the EvilTokens phishing toolkit. ARToken enables attackers to compromise Microsoft 365 accounts by stealing authentication tokens, establishing persistent access via Primary Refresh Tokens (PRTs), and accessing services like Outlook, SharePoint, and OneDrive. The platform also automates business email compromise (BEC) operations and deploys phishing infrastructure through Cloudflare Workers. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/artoken-phaas-exposes-eviltokens-microsoft-365-phishing-toolkit/?utm_source=openai)) This incident highlights the evolving sophistication of phishing platforms, which now offer advanced capabilities to bypass multi-factor authentication and maintain prolonged access to compromised accounts. Organizations must enhance their security measures to counteract these advanced threats.
3 weeks ago
Kill Chain
Unprivileged Users Can Gain Root Access via 'Bad Epoll' Vulnerability in Linux Kernel
In July 2026, a critical vulnerability known as 'Bad Epoll' (CVE-2026-46242) was disclosed in the Linux kernel's eventpoll subsystem. This use-after-free flaw allows unprivileged users to escalate their privileges to root, affecting Linux desktops, servers, and Android devices. The vulnerability arises from a race condition where two kernel components attempt to free the same memory object simultaneously, leading to memory corruption and potential system compromise. A proof-of-concept exploit demonstrates a high success rate in achieving root access, even from within restrictive environments like Chrome's renderer sandbox. The discovery of 'Bad Epoll' underscores the challenges in detecting complex race-condition vulnerabilities within critical system components. Despite prior identification of similar flaws by advanced AI models, this particular issue remained undetected, highlighting the need for continuous and comprehensive security assessments. Organizations are urged to apply the available patches promptly to mitigate potential exploitation risks.
3 weeks ago
Kill Chain
IBM and Red Hat's Project Lightwell: A New Era in Open-Source Security
In May 2026, IBM and Red Hat launched Project Lightwell, a $5 billion initiative aimed at enhancing open-source software security. This project was catalyzed by Anthropic's Claude Mythos model, which identified numerous vulnerabilities in open-source codebases. Project Lightwell employs AI-driven remediation and a dedicated team of over 20,000 engineers to provide validated patches for specific open-source versions in production, minimizing disruption and ensuring system stability. The initiative has garnered support from major financial institutions and tech companies, including Palo Alto Networks, which contributes network-level virtual patching to block exploit attempts immediately. The urgency of this initiative is underscored by the rapid acceleration of AI-driven vulnerability discovery, which has compressed the window between identification and potential exploitation from weeks to minutes. Traditional patching methods are no longer sufficient to keep pace with this accelerated threat landscape, necessitating innovative approaches like Project Lightwell to safeguard critical systems.
3 weeks ago
Kill Chain
Protecting AI Agents from MCP Tool Poisoning Attacks
In June 2026, Microsoft Incident Response detailed a sophisticated attack pattern targeting enterprise AI agents utilizing the Model Context Protocol (MCP). The attack involved malicious modifications to MCP tool descriptions, leading AI agents to execute unauthorized actions, such as exfiltrating sensitive financial data. This exploitation underscores the vulnerabilities inherent in AI agents that transition from passive content reading to active task execution. The incident highlights the critical need for robust security measures as AI agents become more autonomous and integrated into enterprise workflows. With the projected growth of AI agents in enterprises, securing these systems against such sophisticated attacks is paramount to prevent potential data breaches and operational disruptions.
3 weeks ago
Kill Chain
MetaMask Users Targeted in Sophisticated Phishing Attack - July 2026
In July 2026, a sophisticated phishing campaign targeted MetaMask users by sending emails that falsely claimed their cryptocurrency wallets were at risk. The emails pressured recipients to provide their secret recovery phrases under the guise of securing their accounts. The attackers utilized a recently registered domain, captchasolve[.]help, to host the phishing site, effectively deceiving users into compromising their wallets. This incident underscores the evolving tactics of cybercriminals in exploiting user trust and the critical importance of safeguarding recovery phrases. ([isc.sans.edu](https://isc.sans.edu/diary/TA551%2B?utm_source=openai)) The prevalence of such targeted phishing attacks highlights the urgent need for enhanced user education on recognizing and avoiding social engineering schemes. As cryptocurrency adoption grows, both individuals and organizations must implement robust security measures and remain vigilant against deceptive practices that aim to exploit human vulnerabilities.
3 weeks ago
Kill Chain
Defending Against AI-Enhanced Business Email Compromise in 2026
In 2026, Business Email Compromise (BEC) attacks have evolved into sophisticated, multi-stage operations. Threat actors gain access to organizational mailboxes or SaaS accounts, meticulously analyze internal communications, and exploit financial processes to execute fraudulent transactions. The integration of AI technologies has enhanced the quality and efficiency of these scams, making them increasingly difficult to detect. The prevalence of BEC attacks has surged, with 74% of organizations reporting incidents in 2025, up from 63% in 2024. ([nacha.org](https://www.nacha.org/news/business-email-compromise-attempts-rose-sharply-2025-report-finds?utm_source=openai)) This trend underscores the urgent need for organizations to bolster their cybersecurity measures and employee training to mitigate the escalating threat posed by BEC schemes.
3 weeks ago
Kill Chain
Djinn Stealer Exploits SimpleHelp Vulnerability CVE-2026-48558
In June 2026, attackers exploited CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp's OpenID Connect (OIDC) authentication flow, to gain unauthorized access to remote monitoring and management (RMM) systems. By submitting forged identity tokens, they obtained technician-level access without valid credentials, enabling them to deploy the Djinn Stealer malware across Windows, macOS, and Linux systems. Djinn Stealer targeted a wide range of sensitive information, including cloud service credentials, source control data, package registry credentials, AI development tools, and cryptocurrency wallets, posing significant risks to enterprise environments. This incident underscores the increasing focus of threat actors on exploiting vulnerabilities in trusted administrative tools to gain broad access to enterprise networks. The rapid exploitation of CVE-2026-48558 highlights the urgency for organizations to promptly apply security patches and implement robust monitoring to detect unauthorized access, especially in systems that manage critical infrastructure and sensitive data.
3 weeks ago
Kill Chain
Oracle E-Business Suite Flaw CVE-2026-46817 Under Active Attack
In late June 2026, security researchers identified active exploitation of a critical vulnerability (CVE-2026-46817) in Oracle E-Business Suite's Payments module. This flaw, present in versions 12.2.3 through 12.2.15, allows unauthenticated attackers to remotely compromise the system via HTTP, potentially leading to full control over the affected instances. The vulnerability was initially disclosed in May 2026, with a CVSS score of 9.8, indicating severe risks to confidentiality, integrity, and availability. ([thehackernews.com](https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html?utm_source=openai)) The exploitation of CVE-2026-46817 underscores the persistent threat posed by unpatched vulnerabilities in critical business applications. Organizations relying on Oracle E-Business Suite are urged to apply the latest security patches promptly to mitigate potential breaches and safeguard sensitive financial data. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/?utm_source=openai))
3 weeks ago
Kill Chain
Critical Vulnerability in Amazon Q Developer's VS Code Extension Exposes Cloud Credentials
In June 2026, a high-severity vulnerability (CVE-2026-12957) was discovered in Amazon Q Developer's Visual Studio Code extension. This flaw allowed attackers to execute arbitrary code and steal cloud credentials by convincing developers to open malicious repositories. The issue stemmed from the extension's handling of Model Context Protocol (MCP) servers, which automatically loaded and executed configurations from workspace files without user approval, leading to potential exposure of sensitive information such as AWS credentials and API keys. AWS addressed the vulnerability by releasing an update to Language Server version 1.65.0. This incident highlights the growing risks associated with AI coding tools and the importance of scrutinizing their integration into development environments. Organizations are urged to treat AI tools with environment access as potential security risks and implement appropriate guardrails to prevent unauthorized access and data exfiltration.
3 weeks ago
Kill Chain
The Critical Shift to Post-Quantum Cryptography for Credential Security
In June 2026, cybersecurity experts highlighted the imminent threat posed by quantum computing to current cryptographic systems, particularly those safeguarding credentials. As quantum hardware advances, algorithms like RSA and elliptic curve cryptography, which protect sensitive data, are at risk of being compromised. This vulnerability underscores the urgency for organizations to transition to post-quantum cryptography (PQC) to maintain data confidentiality and integrity. ([thehackernews.com](https://thehackernews.com/2026/06/why-post-quantum-cryptography-starts.html?utm_source=openai)) The relevance of this issue is amplified by the increasing prevalence of 'harvest now, decrypt later' attacks, where adversaries collect encrypted data today, anticipating future quantum capabilities to decrypt it. This trend necessitates immediate action to adopt PQC solutions to safeguard long-term data security. ([thehackernews.com](https://thehackernews.com/2026/06/why-post-quantum-cryptography-starts.html?utm_source=openai))
3 weeks ago
Kill Chain
Persistent Cyber Scam Centers in Asia Despite Crackdowns
In June 2026, reports from INTERPOL and Amnesty International highlighted the persistent and escalating issue of cyber scam centers across Asia, particularly in Cambodia, Myanmar, Laos, and the Philippines. Despite high-profile crackdowns and arrests, these operations continue to thrive, generating an estimated $40 billion annually through schemes like romance fraud and investment scams. The resilience of these criminal enterprises is largely attributed to local corruption and collusion with law enforcement, which undermine efforts to dismantle them. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/New-INTERPOL-report-highlights-escalating-cyber-threats-across-Asia-and-South-Pacific?utm_source=openai)) This situation underscores the urgent need for enhanced international cooperation and robust anti-corruption measures. The continued operation of these scam centers not only results in significant financial losses globally but also involves severe human rights abuses, including human trafficking and forced labor. Addressing this issue is critical to protecting vulnerable populations and maintaining global cybersecurity. ([amnesty.org](https://www.amnesty.org/en/latest/news/2026/06/cambodia-evidence-suggests-scamming-compounds-bypassed-despite-high-profile-crackdown/?utm_source=openai))
1 month ago
Kill Chain
Poland's Crackdown on SIM-Swap Crypto Theft: A 2026 Case Study
In June 2026, Polish authorities, with support from the FBI and Homeland Security Investigations, arrested four individuals involved in a sophisticated SIM-swapping scheme targeting cryptocurrency exchanges. The perpetrators breached IT systems of entities collaborating with telecom operators, using specialized software and social engineering to access employee email accounts. This enabled them to hijack victims' phone numbers, intercept SMS messages, and gain control over cryptocurrency exchange accounts, resulting in the theft and laundering of digital assets exceeding tens of millions of Polish zloty. ([thecoinomist.com](https://thecoinomist.com/news/poland-detains-four-sim-swap-crypto-heist-merry-linked/?utm_source=openai)) This incident underscores the escalating threat of SIM-swapping attacks in the cryptocurrency sector, highlighting the need for enhanced security measures beyond SMS-based two-factor authentication. The collaboration between Polish authorities and U.S. agencies reflects the global nature of cybercrime and the importance of international cooperation in combating such threats.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports