The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
Anthropic's Claude Mythos AI: A Game-Changer in Cybersecurity
In April 2026, Anthropic unveiled Claude Mythos Preview, an advanced AI model capable of autonomously identifying and exploiting software vulnerabilities across major operating systems and web browsers. The model discovered thousands of zero-day vulnerabilities, including a 27-year-old flaw in OpenBSD and a 16-year-old bug in FFmpeg. Due to its potent capabilities, Anthropic restricted access to select organizations under Project Glasswing to prevent potential misuse. This initiative involves collaboration with major tech companies to responsibly address and patch these vulnerabilities. The emergence of such powerful AI tools underscores the need for enhanced cybersecurity measures and collaborative efforts to safeguard critical infrastructure. The rapid advancement of AI in cybersecurity presents both opportunities and challenges, necessitating a reevaluation of existing security protocols and the development of new strategies to mitigate potential risks.
5 months ago
Kill Chain
ATHR: AI-Powered Vishing Platform Revolutionizes Automated Attacks
In April 2026, cybersecurity researchers identified 'ATHR,' a sophisticated cybercrime platform that automates voice phishing (vishing) attacks using AI-driven voice agents. The platform orchestrates the entire attack chain: sending deceptive emails that prompt victims to call a provided number, which connects them to AI agents impersonating legitimate support staff. These agents guide victims through a simulated security verification process to extract sensitive information, such as six-digit verification codes, enabling unauthorized access to accounts on services like Google, Microsoft, and Coinbase. The emergence of ATHR underscores a significant evolution in social engineering tactics, leveraging AI to enhance the scale and believability of vishing attacks. This development highlights the urgent need for organizations to bolster their defenses against AI-powered social engineering threats, as traditional detection methods may be insufficient against such advanced techniques.
5 months ago
Kill Chain
Dahua DVRs Compromised: A 2026 Cybersecurity Wake-Up Call
In April 2026, a significant cybersecurity incident was identified involving Dahua Digital Video Recorders (DVRs). Attackers exploited default credentials and unpatched vulnerabilities to gain unauthorized access to these devices. Once compromised, the DVRs were co-opted into botnets, facilitating further malicious activities such as distributed denial-of-service (DDoS) attacks and unauthorized surveillance. This breach underscores the critical need for device owners to change default passwords and regularly update firmware to mitigate such risks. This incident highlights a broader trend of cybercriminals targeting Internet of Things (IoT) devices with default settings and outdated software. As IoT adoption continues to rise, ensuring robust security practices for these devices becomes increasingly vital to prevent their exploitation in large-scale cyberattacks.
5 months ago
Kill Chain
Fake Ledger Live App on Apple App Store Leads to $9.5M Crypto Theft
In April 2026, a counterfeit version of the Ledger Live app was discovered on Apple's Mac App Store, leading to the theft of approximately $9.5 million in cryptocurrency from over 50 users. The malicious app, submitted under the developer name 'Leva Heal Limited,' deceived users into entering their seed phrases, granting attackers full access to their wallets. The stolen funds were laundered through more than 150 deposit addresses on KuCoin, linked to a centralized mixing service called 'AudiA6.' Apple has since removed the fraudulent app from the App Store. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/?utm_source=openai)) This incident underscores the persistent threat of sophisticated phishing attacks targeting cryptocurrency users. It highlights the critical need for vigilance when downloading financial applications, even from official app stores, and the importance of never sharing seed phrases or recovery keys.
5 months ago
Kill Chain
Kraken Faces Insider Threat and Extortion Attempt in 2026
In April 2026, Kraken, a leading cryptocurrency exchange, disclosed two incidents where support staff improperly accessed internal systems, exposing limited client support data. Approximately 2,000 accounts, representing 0.02% of Kraken's user base, were affected. Following these incidents, a criminal group attempted to extort Kraken by threatening to release videos showcasing the internal systems with client data. Kraken confirmed that no core systems were breached, client funds remained secure, and the company refused to comply with the extortion demands. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/crypto-exchange-kraken-extorted-by-hackers-after-insider-breach/?utm_source=openai)) This incident underscores the persistent threat of insider access within organizations, particularly in the cryptocurrency sector. It highlights the importance of robust internal controls, employee monitoring, and rapid response mechanisms to mitigate insider threats and protect sensitive client information.
5 months ago
Kill Chain
Mirax Android RAT: A New Era of Mobile Malware Threats
In April 2026, a sophisticated Android remote access trojan (RAT) named Mirax was identified targeting Spanish-speaking countries. Distributed through Meta advertisements, Mirax infected over 220,000 devices by masquerading as legitimate streaming applications. Once installed, it granted attackers full control over compromised devices, enabling real-time interaction, keystroke logging, and the deployment of dynamic overlays to steal sensitive information. Notably, Mirax transformed infected devices into residential proxy nodes using the SOCKS5 protocol, allowing cybercriminals to route malicious traffic through victims' IP addresses, thereby evading detection systems and facilitating fraudulent activities. This incident underscores a concerning evolution in mobile malware, where traditional RAT functionalities are augmented with proxy capabilities, expanding the operational scope of cybercriminals. The use of social media platforms for widespread distribution highlights the need for enhanced vigilance and security measures among users and organizations to mitigate such threats.
5 months ago
Kill Chain
OpenSSF Tech Talk Recap: Securing Agentic AI
On April 8, 2026, the Open Source Security Foundation (OpenSSF) hosted a Tech Talk titled 'Securing Agentic AI,' addressing the unique security challenges posed by non-deterministic AI agents. Experts from Microsoft, Thread AI, Canonical, and the OpenSSF AI/ML Security Working Group discussed issues such as agent autonomy, tool-model trust, and context integrity. They introduced SAFE-MCP, a threat catalog inspired by the MITRE ATT&CK framework, detailing over 80 attack techniques targeting tool-based Large Language Models (LLMs). The session also emphasized the importance of securing the entire AI infrastructure stack, from user interfaces to hardware, highlighting the critical role of open source in each layer. ([openssf.org](https://openssf.org/blog/2026/04/08/openssf-tech-talk-recap-securing-agentic-ai/?utm_source=openai)) The relevance of this discussion is underscored by recent developments in AI security. For instance, Anthropic's AI model, Claude Mythos, identified thousands of zero-day vulnerabilities across major operating systems and web browsers, some unpatched for decades. This highlights the pressing need for robust security measures in AI systems to prevent potential exploitation. ([tomshardware.com](https://www.tomshardware.com/tech-industry/artificial-intelligence/anthropics-latest-ai-model-identifies-thousands-of-zero-day-vulnerabilities-in-every-major-operating-system-and-every-major-web-browser-claude-mythos-preview-sparks-race-to-fix-critical-bugs-some-unpatched-for-decades?utm_source=openai))
5 months ago
Kill Chain
Storm Infostealer 2026: A New Era of Cyber Threats
In early 2026, a new infostealer malware named 'Storm' emerged, enabling attackers to bypass traditional security measures by exfiltrating encrypted browser data to remote servers for decryption. This method allows the malware to harvest sensitive information such as saved passwords, session cookies, and cryptocurrency wallets without triggering endpoint security alerts. Storm's capabilities extend to automating session hijacking, granting attackers authenticated access to various platforms without the need for passwords or multi-factor authentication. The malware is offered as a subscription service, with packages starting at $300 for a 7-day demo and up to $1,800 for a full team license supporting 100 operators. Notably, data exfiltration continues even after subscriptions expire. The emergence of such turnkey hacking tools underscores the growing accessibility of sophisticated cyberattacks, posing serious risks to organizations relying solely on basic endpoint protections. Advanced behavioral and network analytics are essential for detecting such threats.
5 months ago
Kill Chain
JanelaRAT: Emerging Threat to Latin American Financial Institutions
In June 2023, cybersecurity researchers identified JanelaRAT, a sophisticated banking Trojan targeting financial institutions across Latin America. This malware employs a multi-stage infection chain, beginning with phishing emails that lead victims to download malicious files. Once installed, JanelaRAT utilizes DLL side-loading techniques to evade detection, monitors user activity by capturing window titles, and exfiltrates sensitive financial and cryptocurrency data. Its capabilities include keystroke logging, screenshot capturing, and mouse input tracking, all orchestrated through a dynamic command-and-control infrastructure. The malware's design suggests a focus on stealth and adaptability, posing significant risks to the financial sector in the region. ([securelist.com](https://securelist.com/janelarat-financial-threat-in-latin-america/119332/?utm_source=openai)) The emergence of JanelaRAT underscores a growing trend of targeted cyberattacks against financial institutions in Latin America. Its advanced evasion techniques and continuous evolution highlight the need for enhanced cybersecurity measures and vigilance within the industry to protect sensitive financial data from such sophisticated threats.
5 months ago
Kill Chain
FBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts
In April 2026, the FBI Atlanta Field Office, in collaboration with the Indonesian National Police, dismantled a sophisticated global phishing operation centered around the W3LL phishing kit. This toolkit enabled cybercriminals to create counterfeit login pages, deceiving victims into divulging their credentials. Priced at approximately $500, the kit facilitated the theft of thousands of account credentials and was linked to over $20 million in attempted fraud. Authorities detained the alleged developer, identified as G.L., and seized key domains associated with the operation. The W3LL phishing kit was a comprehensive cybercrime platform that allowed criminals to impersonate legitimate login pages, capturing usernames, passwords, and session data. This capability enabled attackers to bypass multi-factor authentication and maintain unauthorized access to accounts. The operation also included an online marketplace, W3LLSTORE, which facilitated the sale of over 25,000 compromised accounts between 2019 and 2023. Even after W3LLSTORE's shutdown in 2023, the phishing activities continued through encrypted messaging platforms, targeting more than 17,000 victims worldwide between 2023 and 2024.
5 months ago
Kill Chain
JanelaRAT Malware: A Growing Threat to Latin American Banks in 2025
In 2025, Latin American financial institutions, particularly in Brazil and Mexico, faced a significant surge in cyber threats, notably from the JanelaRAT malware. This sophisticated malware, a modified variant of the BX RAT trojan, was designed to steal financial and cryptocurrency data by capturing window titles, tracking mouse inputs, logging keystrokes, taking screenshots, and collecting system metadata. The attackers employed DLL side-loading techniques to evade detection, leveraging legitimate executables to load the malicious payload. The campaign's focus on Latin American banks underscores the region's growing vulnerability to targeted cyber attacks. ([thehackernews.com](https://thehackernews.com/2023/08/new-financial-malware-janelarat-targets.html?utm_source=openai)) The rise of JanelaRAT coincided with a broader increase in cyber threats across Latin America. Reports indicated a 155% increase in social engineering scams and a 225% rise in malware attacks in 2025. ([biocatch.com](https://www.biocatch.com/press-release/latin-american-banks-see-155-increase-in-scam-attempts?hs_amp=true&utm_source=openai)) This trend highlights the evolving tactics of cybercriminals who are increasingly targeting financial institutions in the region, emphasizing the urgent need for enhanced cybersecurity measures and cross-institution collaboration to mitigate these threats.
5 months ago
Kill Chain
Identity-Based Attacks: The Predominant Cyber Threat in 2026
In 2026, identity-based attacks have emerged as the predominant cyber threat, with 67% of incidents involving compromised credentials, session tokens, or other forms of digital identity. Attackers increasingly exploit legitimate access methods, bypassing traditional security measures to infiltrate systems undetected. This shift underscores the critical need for organizations to enhance identity security protocols and adopt continuous monitoring strategies to detect and mitigate unauthorized access. The rise of identity-driven intrusions is further exacerbated by the integration of AI technologies, which enable adversaries to automate and scale their attacks more effectively. As a result, businesses must prioritize robust identity governance and implement advanced detection mechanisms to safeguard against these evolving threats.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports