The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
Iranian APT MuddyWater Infiltrates U.S. Networks Using Dindoor Backdoor
In early February 2026, the Iranian state-sponsored hacking group MuddyWater (also known as Seedworm) infiltrated networks of multiple U.S. organizations, including a bank, an airport, and a software company with Israeli operations. The attackers deployed a previously unknown backdoor named Dindoor, which utilizes the Deno JavaScript runtime for execution. Additionally, they attempted data exfiltration using the Rclone utility to a Wasabi cloud storage bucket. The initial access methods remain unclear, but MuddyWater is known for using phishing emails and exploiting vulnerabilities in public-facing applications. ([thehackernews.com](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html?utm_source=openai)) This incident underscores the evolving capabilities of Iranian threat actors, who have demonstrated improved tooling and social engineering tactics. The timing of these intrusions, coinciding with escalating geopolitical tensions following U.S. and Israeli military actions, highlights the potential for cyber operations to serve as instruments of state power during periods of conflict. ([thehackernews.com](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html?utm_source=openai))
6 months ago
Kill Chain
Global Takedown of Tycoon 2FA Phishing Platform in 2026
In March 2026, a coordinated international operation led by Europol, Microsoft, and other industry partners successfully dismantled Tycoon 2FA, a prominent phishing-as-a-service (PhaaS) platform active since August 2023. Tycoon 2FA enabled cybercriminals to bypass multi-factor authentication (MFA) by employing adversary-in-the-middle (AiTM) techniques, intercepting live authentication sessions to capture credentials and session tokens. This platform facilitated unauthorized access to nearly 100,000 organizations globally, including schools, hospitals, and public institutions, by generating tens of millions of phishing emails each month. The takedown involved seizing 330 domains that formed the core infrastructure of Tycoon 2FA, significantly disrupting its operations. ([blogs.microsoft.com](https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/?utm_source=openai)) The dismantling of Tycoon 2FA underscores the evolving sophistication of phishing attacks and the critical need for robust security measures. Despite this significant disruption, the techniques employed by Tycoon 2FA, such as AiTM phishing and rapid infrastructure rotation, are likely to be adopted by other threat actors, highlighting the importance of continuous vigilance and adaptive defense strategies. ([rescana.com](https://www.rescana.com/post/europol-dismantles-tycoon-2fa-inside-the-takedown-of-a-64-000-attack-phishing-as-a-service-platform?utm_source=openai))
6 months ago
Kill Chain
Dismantling Tycoon 2FA: A Major Step in Combating Phishing-as-a-Service
In March 2026, a coordinated operation led by Europol, Microsoft, and industry partners successfully dismantled Tycoon 2FA, a prominent phishing-as-a-service platform active since August 2023. Tycoon 2FA enabled cybercriminals to bypass multi-factor authentication (MFA) by intercepting live authentication sessions, capturing credentials, one-time passcodes, and session cookies in real time. The platform was responsible for tens of millions of phishing emails each month, facilitating unauthorized access to nearly 100,000 organizations globally, including schools, hospitals, and public institutions. The takedown involved seizing 330 domains integral to Tycoon 2FA's infrastructure, significantly disrupting its operations and mitigating further harm. This incident underscores the evolving sophistication of phishing attacks and the critical need for organizations to adopt phishing-resistant authentication mechanisms and enforce strict conditional access controls to protect against such threats.
6 months ago
Kill Chain
FBI and Europol Dismantle LeakBase Cybercriminal Forum in 2026
In early March 2026, a coordinated international law enforcement operation led by the FBI and Europol successfully dismantled LeakBase, one of the world's largest online forums for cybercriminals. Established in 2021, LeakBase had over 142,000 registered users and facilitated the trade of stolen data, including account credentials, credit card numbers, and other sensitive personal information. The operation involved seizing the forum's domains, arresting key individuals, and preserving extensive user data for evidentiary purposes. ([justice.gov](https://www.justice.gov/usao-ut/pr/united-states-leads-dismantlement-one-worlds-largest-hacker-forums?utm_source=openai)) This takedown underscores the escalating global efforts to combat cybercrime and disrupt platforms that enable the illicit exchange of stolen data. The success of this operation highlights the importance of international collaboration in addressing the growing threat posed by cybercriminal forums and marketplaces.
6 months ago
Kill Chain
Global Operation Dismantles Tycoon2FA Phishing Platform
In March 2026, a coordinated international operation led by Europol and Microsoft successfully dismantled Tycoon2FA, a prominent phishing-as-a-service (PhaaS) platform active since August 2023. Tycoon2FA enabled cybercriminals to bypass multi-factor authentication (MFA) by intercepting live authentication sessions, capturing credentials, one-time passcodes, and session cookies in real time. This service was responsible for tens of millions of phishing emails each month, targeting over 500,000 organizations globally, including schools, hospitals, and public institutions. The takedown involved seizing 330 domains that formed the platform's core infrastructure, significantly disrupting its operations and mitigating further harm. ([blogs.microsoft.com](https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/?utm_source=openai)) The dismantling of Tycoon2FA underscores the evolving sophistication of cyber threats, particularly the commoditization of tools that facilitate large-scale MFA bypass attacks. This incident highlights the critical need for organizations to adopt phishing-resistant authentication mechanisms and enhance their cybersecurity posture to defend against such advanced threats. ([newsroom.trendmicro.com](https://newsroom.trendmicro.com/2026-03-04-TrendAI-TM-Helps-Drive-Global-Takedown-of-Tycoon-2FA-MFA-Bypass-Phishing-Service?utm_source=openai))
6 months ago
Kill Chain
2025 Mobile Malware Surge: Key Threats and Protective Measures
In 2025, Kaspersky's analysis revealed a significant surge in mobile malware attacks, with over 14 million incidents involving malicious, advertising, or unwanted software targeting mobile devices. Notably, adware constituted 62% of these detections, while the number of new Trojan banker installation packages for Android escalated to 255,090, marking a 271% increase from the previous year. This sharp rise underscores the growing profitability of such attacks for cybercriminals. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/the-number-of-trojan-banker-attacks-on-smartphones-increased-by-56-in-2025?utm_source=openai)) The proliferation of preinstalled backdoors like Triada and Keenadu, embedded during device manufacturing, presents a formidable challenge, granting attackers extensive control over compromised devices. Additionally, the emergence of the Kimwolf IoT botnet, which exploits Android TV boxes for DDoS attacks and as reverse proxies, highlights the expanding threat landscape. These developments necessitate heightened vigilance and robust security measures to safeguard mobile users. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/the-number-of-trojan-banker-attacks-on-smartphones-increased-by-56-in-2025?utm_source=openai))
6 months ago
Kill Chain
INTERPOL's Operation Sentinel: A Landmark Cybercrime Crackdown in Africa
Between October 27 and November 27, 2025, INTERPOL coordinated Operation Sentinel, a significant cybercrime crackdown across 19 African countries. The operation led to the arrest of 574 suspects involved in business email compromise (BEC), digital extortion, and ransomware attacks. Authorities dismantled over 6,000 malicious links, decrypted six ransomware variants, and recovered approximately USD 3 million. The cases investigated were linked to estimated financial losses exceeding USD 21 million. Notable incidents included a thwarted USD 7.9 million BEC attempt targeting a petroleum company in Senegal and a ransomware attack in Ghana that encrypted 100 terabytes of data, with nearly 30 terabytes successfully recovered. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai)) This operation underscores the escalating threat of cybercrime in Africa, with online offenses now accounting for a significant proportion of all crimes in many regions. The success of Operation Sentinel highlights the effectiveness of international collaboration in combating cyber-related offenses and the critical need for continued vigilance and cooperation to protect critical infrastructure and sensitive data. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai))
6 months ago
Kill Chain
Starkiller Phishing Kit: A New Era of MFA Bypass Attacks
In early 2026, cybersecurity researchers uncovered 'Starkiller,' a sophisticated phishing-as-a-service (PhaaS) platform developed by the cybercrime group Jinkusu. Unlike traditional phishing kits that rely on static HTML clones, Starkiller employs a headless Chrome browser within a Docker container to proxy legitimate login pages in real-time. This adversary-in-the-middle (AiTM) approach allows attackers to intercept user credentials and session tokens, effectively bypassing multi-factor authentication (MFA) mechanisms. The platform's user-friendly control panel enables even low-skilled cybercriminals to launch advanced phishing campaigns, posing a significant threat to organizations relying solely on conventional MFA for security. ([abnormal.ai](https://abnormal.ai/blog/starkiller-phishing-kit?utm_source=openai)) The emergence of Starkiller underscores a critical shift in the cyber threat landscape, highlighting the limitations of traditional MFA solutions against evolving phishing techniques. Organizations must adopt phishing-resistant authentication methods, such as FIDO2/WebAuthn-based hardware security keys, and implement continuous monitoring for anomalous session behaviors to mitigate the risks posed by such advanced phishing platforms. ([bytearchitect.io](https://bytearchitect.io/network-security/Starkiller-Phishing-Kit-Why-MFA-Fails-Against-Real-Time-Reverse-Proxies/?utm_source=openai))
6 months ago
Kill Chain
Project Compass: Unveiling the Arrests in 'The Com' Cybercrime Network
In January 2025, Europol initiated Project Compass, a coordinated international operation targeting 'The Com,' a decentralized cybercriminal collective known for engaging in ransomware attacks, financial extortion, and the exploitation of minors. Over the course of the year, the operation led to the arrest of 30 individuals and the identification of 179 additional suspects across 28 countries. Investigators also identified 62 victims, with four being directly safeguarded from further harm. 'The Com' primarily consists of English-speaking individuals aged 16 to 25, who utilize social media platforms, messaging applications, and online gaming environments to recruit and exploit young people. The group's decentralized structure and use of various online platforms have made it particularly challenging for law enforcement to disrupt their activities. The success of Project Compass underscores the importance of international collaboration in combating cybercrime and highlights the ongoing threat posed by such decentralized networks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/27/europol-the-com-network-arrests/?utm_source=openai)) The significance of this operation is underscored by the increasing prevalence of cybercriminal groups targeting vulnerable populations through online platforms. The arrest of key members of 'The Com' serves as a critical reminder of the need for continuous vigilance and proactive measures to protect minors from online exploitation. Additionally, the operation highlights the evolving tactics of cybercriminals, who are increasingly leveraging decentralized networks and social engineering techniques to perpetrate their crimes. ([darkreading.com](https://www.darkreading.com/threat-intelligence/30-alleged-members-the-com-arrested-project-compass/?utm_source=openai))
6 months ago
Kill Chain
IBM Bob's 2026 Prompt Injection Vulnerability Exposes AI Security Risks
In January 2026, security researchers at Prompt Armor identified a critical vulnerability in IBM's generative AI tool, Bob, which was in its beta phase. The flaw allowed for indirect prompt injection attacks, enabling malicious actors to embed hidden commands within emails or calendar entries. When Bob processed these inputs, it could be manipulated to perform unauthorized actions such as data exfiltration, malware execution, or establishing persistent system access. This vulnerability was particularly concerning due to Bob's integration capabilities with other applications, amplifying the potential attack surface. The incident underscores the inherent risks associated with AI systems that process untrusted data sources. As AI tools become more integrated into business workflows, the potential for such vulnerabilities increases, highlighting the need for robust security measures. Organizations must prioritize the development and implementation of safeguards to prevent prompt injection attacks and ensure the secure deployment of AI technologies.
6 months ago
Kill Chain
Deepfake Injection Attacks: A Growing Threat to Identity Verification in 2025
In 2025, the financial sector faced a significant surge in deepfake and injection attacks targeting identity verification processes. Fraudsters utilized AI-generated media to impersonate individuals during onboarding and authentication, leading to unauthorized access and substantial financial losses. Notably, a multinational firm in Singapore was nearly defrauded of $500,000 when attackers used deepfake video avatars to impersonate company executives during a Zoom call. ([regulaforensics.com](https://regulaforensics.com/blog/identity-verification-incidents-2025/?utm_source=openai)) This incident underscores the escalating threat posed by deepfake technologies in compromising identity verification systems. The increasing sophistication and accessibility of AI tools have enabled attackers to bypass traditional security measures, highlighting the urgent need for enhanced detection and prevention strategies.
6 months ago
Kill Chain
AI-Assisted Cyberattack Compromises 600+ FortiGate Firewalls Globally
Between January 11 and February 18, 2026, a Russian-speaking threat actor utilized commercial generative AI tools to compromise over 600 Fortinet FortiGate firewalls across 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking two-factor authentication, without leveraging any specific software vulnerabilities. Once access was gained, AI-generated scripts were employed to extract and decrypt sensitive data, including SSL-VPN credentials, administrative passwords, and network configurations. This information facilitated further network infiltration and reconnaissance activities. ([cybernews.com](https://cybernews.com/security/threat-actor-ai-tools-claude-fortinet-fortigate/?utm_source=openai)) This incident underscores the evolving threat landscape where AI tools enable even low-skilled attackers to execute large-scale, sophisticated cyberattacks. Organizations must reassess their security postures, emphasizing the importance of robust authentication mechanisms and the need to secure management interfaces against unauthorized access.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports