The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
BTMOB: The No-Code Android Malware Service Empowering Cybercriminals
In May 2026, cybersecurity researchers identified BTMOB, an Android remote access trojan (RAT) offered as a malware-as-a-service (MaaS) platform. BTMOB provides cybercriminals with a no-code APK builder, enabling the creation of customized phishing payloads without programming expertise. The malware grants attackers extensive control over infected devices, including data exfiltration, financial transaction interception, screenshot capture, and remote operation. Distributed primarily through phishing websites impersonating legitimate services, BTMOB has been notably active in Brazil and Latin America. Its accessibility and comprehensive feature set pose a significant threat to Android users globally. The emergence of BTMOB underscores a concerning trend in the cyber threat landscape: the commoditization of sophisticated malware through MaaS platforms. This development lowers the barrier to entry for cybercriminals, facilitating the rapid proliferation of advanced threats. Organizations must remain vigilant, as the ease of deploying such malware increases the risk of widespread attacks targeting mobile devices.
4 months ago
Kill Chain
BTMOB RAT: A New Android Malware-as-a-Service Threat
In May 2026, cybersecurity researchers identified BTMOB, an Android Remote Access Trojan (RAT), actively targeting users in Brazil and Latin America. Distributed through phishing campaigns that mimic legitimate services, BTMOB is sold as a malware-as-a-service (MaaS), allowing attackers to create malicious apps without coding expertise. Once installed, it exploits Android's Accessibility Services to gain elevated permissions, enabling data exfiltration, screen capture, and full remote control of infected devices. This comprehensive access poses significant risks, including financial theft and privacy breaches. The emergence of BTMOB underscores a growing trend in the commoditization of sophisticated malware, lowering the barrier for cybercriminals and expanding the threat landscape. Its MaaS model facilitates rapid adaptation and distribution, making it a formidable challenge for cybersecurity defenses worldwide.
4 months ago
Kill Chain
Grandoreiro and BTMOB Malware Campaigns: A 2026 Cybersecurity Threat
In May 2026, cybersecurity firms WatchGuard and ESET identified two sophisticated banking trojan campaigns targeting Windows and Android users in Latin America and Europe. The Grandoreiro malware, active since 2016, employs DLL side-loading techniques to infiltrate Windows systems, primarily targeting financial institutions in Portugal. Concurrently, the BTMOB remote access trojan (RAT) compromises Android devices, enabling attackers to exfiltrate sensitive data and gain remote control. These campaigns utilize phishing emails and deceptive websites to distribute malicious payloads, posing significant threats to both individual users and organizations. The persistence and evolution of these malware families underscore the adaptability of financially motivated threat actors. By leveraging legitimate services and employing advanced evasion techniques, such as WebRTC communications and anti-analysis checks, these campaigns highlight the increasing complexity of modern cyber threats and the necessity for robust, multi-layered security defenses.
4 months ago
Kill Chain
BTMOB Android RAT: Unveiling a Stealthy Mobile Threat
In early 2025, the BTMOB Android Remote Access Trojan (RAT) emerged as a significant cybersecurity threat, evolving from the SpySolr malware. Unlike traditional banking trojans, BTMOB offers adversaries extensive capabilities, including data exfiltration, screenshot capture, activity recording, and full remote control of infected devices. Distributed primarily through phishing campaigns that mimic legitimate services, victims are lured into downloading malicious APKs from fake app stores. Once installed, BTMOB exploits Android's Accessibility Services to gain elevated permissions, enabling it to operate stealthily and grant attackers comprehensive access to the device. The malware's commercialization through a no-code APK builder interface lowers the barrier for cybercriminals, allowing rapid generation of new payloads and tailored phishing lures without coding expertise. This ease of customization and distribution has led to its proliferation beyond initial detections in Brazil, posing a global threat to Android users. ([welivesecurity.com](https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/?utm_source=openai))
4 months ago
Kill Chain
Anthropic's AI Model Uncovers Thousands of Software Vulnerabilities
In April 2026, Anthropic launched Project Glasswing, utilizing its advanced AI model, Claude Mythos Preview, to identify vulnerabilities in critical software systems. Within the first month, the initiative uncovered over 10,000 high- or critical-severity vulnerabilities across various platforms, including major operating systems and web browsers. Notably, partners like Cloudflare reported discovering 2,000 bugs, with 400 classified as high or critical severity. This rapid identification underscores the model's capability to detect longstanding vulnerabilities that have eluded traditional methods. The surge in discovered vulnerabilities has shifted the cybersecurity focus from detection to remediation. The bottleneck now lies in the human capacity to triage, report, and deploy patches for these issues. As AI models like Mythos become more prevalent, organizations must adapt their security strategies to address the increasing volume of vulnerabilities and the urgency of timely patching.
4 months ago
Kill Chain
Lazarus Group's RemotePE: A New Memory-Only Threat to Financial Institutions
In May 2026, cybersecurity researchers uncovered a sophisticated attack campaign by the North Korean state-sponsored Lazarus Group targeting financial and cryptocurrency organizations. The group deployed a cross-platform, memory-only Remote Access Trojan (RAT) named RemotePE, which operates entirely in memory, leaving no artifacts on the filesystem. The attack chain involves two loaders: DPAPILoader, which decrypts and loads RemotePELoader using the Windows Data Protection API, and RemotePELoader, which contacts a command-and-control server to fetch and execute RemotePE in memory. This multi-stage approach allows the malware to evade traditional detection mechanisms and maintain persistent access to compromised systems. ([thehackernews.com](https://thehackernews.com/2026/05/lazarus-deploys-remotepe-memory-only.html?utm_source=openai)) The discovery of RemotePE highlights the Lazarus Group's continued evolution in cyber-attack methodologies, emphasizing the need for organizations to adopt advanced threat detection and response strategies. The use of memory-only malware underscores the importance of monitoring in-memory activities and implementing robust endpoint detection and response (EDR) solutions to detect and mitigate such sophisticated threats.
4 months ago
Kill Chain
Cross-Platform NPM Stealer: A 2026 Supply Chain Threat
In May 2026, a sophisticated cross-platform malware targeting Node.js environments was discovered. This stealer malware, embedded within obfuscated JavaScript code, specifically aimed at Windows, macOS, and Linux systems. It was designed to extract sensitive information, including browser credentials and cryptocurrency wallet data, from various browsers such as Chrome, Brave, Edge, and others. The malware utilized Base64-encoded strings and obfuscation techniques to evade detection, with its payloads embedded in plain text. Notably, it established communication with a command-and-control server at IP address 216.126.225.243, known to be associated with the DPRK OtterCookie C2 infrastructure. This incident underscores the escalating threat posed by supply chain attacks within the npm ecosystem. The malware's ability to operate across multiple platforms and its focus on exfiltrating sensitive data highlight the need for enhanced vigilance among developers and organizations. The use of obfuscation and legitimate-looking code to mask malicious intent further complicates detection efforts, emphasizing the importance of robust security practices and continuous monitoring of software dependencies.
4 months ago
Kill Chain
GitHub's 2026 Internal Repositories Breach: A Supply Chain Attack by TeamPCP
In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious Visual Studio Code extension. This intrusion led to the exfiltration of approximately 3,800 internal repositories containing proprietary source code. The threat actor group known as TeamPCP claimed responsibility for the attack, offering the stolen data for sale on cybercrime forums with a starting price of $50,000. GitHub's investigation confirmed the breach but found no evidence that customer data stored outside its internal repositories was affected. This incident underscores the escalating threat of supply chain attacks targeting development environments. The use of compromised development tools to infiltrate organizations highlights the need for enhanced vigilance and security measures within software supply chains. Organizations must prioritize the integrity of their development tools and implement robust monitoring to detect and prevent such sophisticated attacks.
4 months ago
Kill Chain
YellowKey Zero-Day: Bypassing BitLocker Encryption with Physical Access
In May 2026, a security researcher known as 'Nightmare Eclipse' publicly disclosed a zero-day vulnerability named 'YellowKey' affecting Windows BitLocker encryption. This flaw allows attackers with physical access to a device to bypass BitLocker protections using a USB drive containing specially crafted 'FsTx' files. By rebooting into the Windows Recovery Environment (WinRE) and triggering a shell with unrestricted access, attackers can access encrypted data without requiring user credentials. Microsoft has acknowledged the vulnerability, assigned it CVE-2026-45585, and provided mitigation guidance to protect affected systems. The disclosure of YellowKey underscores the critical importance of physical security measures and the need for prompt application of security updates. Organizations should review their device access policies and implement the recommended mitigations to prevent potential exploitation of this vulnerability.
4 months ago
Kill Chain
Critical Vulnerability in ZKTeco CCTV Cameras: CVE-2026-8598
In May 2026, a critical vulnerability (CVE-2026-8598) was identified in ZKTeco CCTV cameras, specifically affecting the SSC335-GC2063-Face-0b77 model with firmware versions prior to V5.0.1.2.20260421. This flaw involved an undocumented configuration export port that lacked authentication, potentially exposing sensitive information such as camera account credentials and open services. Exploitation of this vulnerability could lead to unauthorized access and control over the affected devices. This incident underscores the importance of securing physical security devices, as they can serve as entry points for broader network compromises. Organizations are urged to promptly update their firmware to the latest version and implement robust network segmentation to mitigate such risks.
4 months ago
Kill Chain
Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit
In May 2026, a security researcher known as Nightmare-Eclipse publicly disclosed a vulnerability named 'YellowKey' (CVE-2026-45585) affecting Windows 11 and Windows Server 2025. This flaw allows attackers with physical access to bypass BitLocker encryption by exploiting the Windows Recovery Environment (WinRE), thereby gaining unauthorized access to encrypted data. The exploit involves placing specially crafted 'FsTx' files on a USB drive, booting into WinRE, and triggering an unrestricted shell with full access to the encrypted volume. The public disclosure of YellowKey highlights the ongoing risks associated with physical access attacks and underscores the importance of robust security measures beyond software-based protections. Organizations must reassess their physical security protocols and implement additional safeguards, such as requiring a PIN at startup, to mitigate such vulnerabilities.
4 months ago
Kill Chain
Axios npm Package Compromise: A 2026 Supply Chain Attack
In late March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely-used JavaScript HTTP client library. They published two malicious versions, `axios@1.14.1` and `axios@0.30.4`, which included a trojanized dependency named `plain-crypto-js`. This dependency executed a `postinstall` script that downloaded and installed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux systems. The malicious packages were available for approximately three hours before being removed by npm. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-rat?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting open-source software repositories. The rapid deployment and removal of the malicious packages highlight the need for vigilant monitoring and swift response mechanisms within the software development community.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports