The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
FBI Reports Surge in ATM Jackpotting Attacks in 2025
In 2025, the FBI reported a significant surge in ATM 'jackpotting' attacks across the United States, with over 700 incidents leading to more than $20 million in losses. These attacks involve cybercriminals exploiting physical and software vulnerabilities in ATMs to deploy malware, such as Ploutus, which forces machines to dispense cash without legitimate transactions. Attackers often gain access using generic keys to open ATM panels, then install malware that manipulates the ATM's operating system to execute unauthorized cash withdrawals. ([techcrunch.com](https://techcrunch.com/2026/02/19/fbi-says-atm-jackpotting-attacks-are-on-the-rise-and-netting-hackers-millions-in-stolen-cash/?utm_source=openai)) This trend underscores the evolving tactics of cybercriminals who blend physical intrusion with sophisticated malware to exploit financial systems. The rise in such attacks highlights the urgent need for financial institutions to enhance ATM security measures, including updating software, implementing robust physical security protocols, and educating staff on emerging threats to prevent substantial financial losses and maintain customer trust.
7 months ago
Kill Chain
PayPal's 2025 Data Breach: A Cautionary Tale in Financial Data Security
In 2025, PayPal experienced a significant data breach due to a code change in its Working Capital application, which inadvertently exposed sensitive customer information, including Social Security numbers and dates of birth, for nearly six months. The breach was discovered on December 12, 2025, but had been active since July 1, 2025. Approximately 100 customers were affected by this incident. ([cybernews.com](https://cybernews.com/security/paypal-six-month-breach-ssn-working-capital-app/?utm_source=openai)) This incident underscores the critical importance of rigorous code review processes and robust access controls in financial applications. The prolonged exposure period highlights the necessity for continuous monitoring and rapid response mechanisms to detect and mitigate unauthorized access to sensitive data.
7 months ago
Kill Chain
Credential Theft Leads to Massive Data Breach at French Ministry of Finance
In late January 2026, the French Ministry of Finance reported a significant data breach involving unauthorized access to the national bank account registry, FICOBA. A threat actor exploited stolen credentials from a government official to access sensitive information on approximately 1.2 million bank accounts. The compromised data included bank account details (RIBs/IBANs), account holder identities, physical addresses, and, in some cases, taxpayer identification numbers. Upon detection, the Ministry promptly restricted the unauthorized access and initiated measures to notify affected individuals and financial institutions. This incident underscores the critical importance of robust access controls and credential management within governmental systems. The breach highlights the escalating risks associated with credential theft and the necessity for enhanced cybersecurity measures to protect sensitive financial data. Organizations are urged to reassess their security protocols to mitigate similar threats.
7 months ago
Kill Chain
FBI Reports Surge in ATM Jackpotting Attacks in 2025
In 2025, the FBI reported a significant surge in ATM jackpotting incidents across the United States, with over 700 attacks resulting in more than $20 million in losses. These attacks involve cybercriminals exploiting physical and software vulnerabilities in ATMs, often deploying malware like Ploutus to force machines to dispense cash without legitimate transactions. Criminals typically gain access by using generic keys to open ATM fronts and then install malware to control the machines remotely. This alarming trend underscores the evolving tactics of cybercriminals and highlights the urgent need for financial institutions to bolster their ATM security measures. The rise in such sophisticated attacks calls for enhanced vigilance and the implementation of robust security protocols to protect against these threats.
7 months ago
Kill Chain
ClickFix Campaign 2026: Unveiling the MIMICRAT Malware Threat
In February 2026, a sophisticated cyber campaign known as ClickFix was identified, leveraging compromised legitimate websites to distribute a custom remote access trojan (RAT) named MIMICRAT. The attack initiated through a legitimate Bank Identification Number (BIN) validation service, bincheck.io, which was breached to inject malicious JavaScript. This script redirected users to a fake Cloudflare verification page, prompting them to execute a PowerShell command that ultimately deployed MIMICRAT. The RAT featured capabilities such as Windows token impersonation, SOCKS5 tunneling, and a suite of 22 commands for extensive post-exploitation activities. Victims spanned multiple geographies, including a U.S.-based university and various Chinese-speaking users, indicating broad opportunistic targeting. This incident underscores the evolving nature of cyber threats, where attackers exploit trusted websites to deliver sophisticated malware. The use of multi-stage PowerShell scripts and the deployment of custom RATs like MIMICRAT highlight the increasing complexity of attack vectors. Organizations must remain vigilant, ensuring robust security measures are in place to detect and mitigate such advanced threats.
7 months ago
Kill Chain
Abu Dhabi Finance Week 2026 Data Breach: A Cloud Misconfiguration Exposes VIP Passport Details
In early February 2026, Abu Dhabi Finance Week (ADFW) experienced a significant data breach due to a misconfigured cloud storage environment managed by a third-party vendor. This misconfiguration exposed scans of over 700 passports and identity cards belonging to high-profile attendees, including former British Prime Minister David Cameron and U.S. investor Anthony Scaramucci. The breach was discovered by cybersecurity researcher Roni Suchowski, who found that the sensitive documents were publicly accessible without password protection. Upon notification, ADFW promptly secured the environment and stated that access activity was limited to the researcher who identified the issue. The incident underscores the critical importance of securing cloud storage configurations to prevent unauthorized access to sensitive information. ([techradar.com](https://www.techradar.com/pro/security/abu-dhabi-finance-summit-exposes-personal-data-passport-info-of-hundreds-of-major-global-figures?utm_source=openai)) This breach highlights the ongoing risks associated with cloud misconfigurations, which continue to be a leading cause of data exposure. As organizations increasingly rely on cloud services, ensuring proper configuration and regular security audits is essential to protect sensitive data and maintain trust with stakeholders.
7 months ago
Kill Chain
Starkiller Phishing Kit: A New Era of MFA Bypass Attacks
In February 2026, cybersecurity researchers uncovered 'Starkiller,' a sophisticated phishing-as-a-service (PhaaS) platform that enables cybercriminals to bypass multi-factor authentication (MFA) by proxying live login pages. Unlike traditional phishing kits that use static HTML clones, Starkiller employs a headless Chrome browser within a Docker container to relay real-time authentication sessions, capturing credentials, MFA codes, and session tokens as users interact with legitimate sites. This approach allows attackers to harvest sensitive information without raising user suspicion. The platform is distributed on the dark web with a subscription model, offering updates and customer support, thereby lowering the technical barrier for launching credential-stealing campaigns at scale. ([darkreading.com](https://www.darkreading.com/threat-intelligence/starkiller-phishing-kit-mfa/?utm_source=openai)) The emergence of Starkiller highlights a significant escalation in phishing infrastructure, demonstrating a shift towards real-time, session-aware compromises that render traditional detection methods, such as static page analysis and URL blocklisting, less effective. Organizations are urged to adopt behavioral and identity-aware detection strategies, including monitoring for anomalous sign-ins and session token reuse, to mitigate the risks posed by such advanced phishing platforms. ([darkreading.com](https://www.darkreading.com/threat-intelligence/starkiller-phishing-kit-mfa/?utm_source=openai))
7 months ago
Kill Chain
Massiv Android Banking Malware: A New Threat in 2026
In early 2026, cybersecurity researchers identified a new Android banking malware named Massiv, which masquerades as IPTV applications to infiltrate devices. Once installed, Massiv employs screen overlays and keylogging to steal sensitive information, including banking credentials, and can remotely control compromised devices. Notably, it targeted the Portuguese government's Chave Móvel Digital app, potentially allowing attackers to bypass KYC verifications and access banking accounts. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-massiv-android-banking-malware-poses-as-an-iptv-app/?utm_source=openai)) This incident underscores a growing trend where cybercriminals exploit popular app themes, like IPTV, to distribute malware. The increasing sophistication of such attacks highlights the urgent need for enhanced mobile security measures and user vigilance against downloading apps from unverified sources.
7 months ago
Kill Chain
Operation Red Card 2.0: Unveiling Africa's Cybercrime Crackdown
Between December 8, 2025, and January 30, 2026, INTERPOL coordinated Operation Red Card 2.0, leading to the arrest of 651 individuals across 16 African countries. This operation targeted cybercriminal networks involved in investment fraud, mobile money scams, and fraudulent loan applications, resulting in the identification of 1,247 victims and the recovery of over $4.3 million. Authorities also seized 2,341 devices and dismantled 1,442 malicious websites, domains, and servers. Notably, in Nigeria, police dismantled an investment fraud ring and arrested six individuals who had breached a major telecom provider using stolen employee credentials. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/Major-operation-in-Africa-targeting-online-scams-nets-651-arrests-recovers-USD-4.3-million?utm_source=openai)) This operation underscores the escalating threat of cybercrime in Africa, with online scams and financial frauds becoming increasingly prevalent. The success of Operation Red Card 2.0 highlights the critical need for international collaboration and proactive measures to combat transnational cybercriminal activities effectively.
7 months ago
Kill Chain
ShinyHunters' 2026 Attack: Exploiting OAuth Device Code Flow in Microsoft Entra
In early 2026, the cybercriminal group ShinyHunters orchestrated a sophisticated attack targeting Microsoft Entra accounts. By combining device code phishing with voice phishing (vishing), they exploited the OAuth 2.0 Device Authorization flow. Attackers generated legitimate device codes and, through impersonation of IT staff, convinced employees to enter these codes on authentic Microsoft login pages. This manipulation granted the attackers valid authentication tokens, enabling unauthorized access to victims' accounts and associated Single Sign-On (SSO) applications, including Microsoft 365, Salesforce, and Google Workspace. The breach led to significant data exfiltration and subsequent extortion attempts. This incident underscores a concerning evolution in phishing tactics, moving beyond traditional credential theft to the exploitation of trusted authentication processes. The success of such attacks highlights the pressing need for organizations to adopt phishing-resistant multi-factor authentication (MFA) methods and to enhance employee awareness regarding emerging social engineering techniques.
7 months ago
Kill Chain
Massiv Android Trojan Exploits IPTV Apps for Device Takeover Attacks in 2026
In early 2026, cybersecurity researchers identified a new Android trojan named Massiv, which masquerades as IPTV applications to infiltrate devices. Once installed, Massiv enables attackers to remotely control infected devices, facilitating device takeover attacks that lead to unauthorized financial transactions from victims' banking accounts. The malware employs techniques such as screen streaming, keylogging, SMS interception, and fake overlays to steal sensitive information. Notably, it has targeted applications like Portugal's gov.pt, exploiting digital identity systems to bypass Know Your Customer (KYC) verifications and open fraudulent accounts in victims' names. This incident underscores the evolving tactics of cybercriminals who exploit popular app themes to distribute malware, highlighting the need for heightened vigilance among mobile banking users. The use of IPTV app disguises reflects a broader trend of leveraging entertainment-related applications to deceive users, emphasizing the importance of downloading apps only from trusted sources and maintaining robust security practices.
7 months ago
Kill Chain
INTERPOL's Operation Red Card 2.0: A Major Blow to African Cybercrime Networks
Between December 8, 2025, and January 30, 2026, INTERPOL coordinated Operation Red Card 2.0, a collaborative effort involving law enforcement agencies from 16 African countries. This operation targeted transnational cybercriminal networks engaged in high-yield investment scams, mobile money fraud, and fraudulent mobile loan applications. The concerted efforts led to the arrest of 651 individuals, the recovery of over $4.3 million, and the dismantling of 1,442 malicious infrastructures, including IPs, domains, and servers. Investigations revealed that these scams were responsible for financial losses exceeding $45 million, affecting 1,247 victims across Africa and beyond. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/Major-operation-in-Africa-targeting-online-scams-nets-651-arrests-recovers-USD-4.3-million?utm_source=openai)) The success of Operation Red Card 2.0 underscores the escalating threat posed by organized cybercrime syndicates and highlights the critical importance of international collaboration in combating these pervasive threats. The operation also emphasizes the need for continuous vigilance and proactive measures to protect individuals and businesses from evolving cyber fraud schemes.
7 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports