The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
Uzbekistan Telegram Users Hit by Sophisticated Android SMS-Stealer Campaign in 2024
In early 2024, Android users in Uzbekistan experienced a surge of targeted attacks as cybercriminals deployed SMS-stealer malware through phishing campaigns delivered via Telegram. The attackers leveraged fake and malicious applications purpose-built to intercept and exfiltrate SMS messages, enabling unauthorized access to multi-factor authentication codes and banking credentials. Threat actors demonstrated increasing sophistication and adaptability by iterating on malware variants, incorporating obfuscation tactics, and exploiting the popularity of Telegram as a distribution channel. This resulted in significant risks of financial theft and compromised user privacy across a large segment of Uzbek Android device users. This incident highlights the evolving landscape of mobile infostealer attacks in Central Asia, with a marked uptick in the use of instant messaging platforms as malware delivery vectors. The swift adaptation of criminal tactics underscores the necessity for organizations and individuals to strengthen mobile endpoint security and remain vigilant against increasingly convincing phishing and sideloading threats.
8 months ago
Kill Chain
US DOJ Indicts 54 for Ploutus Malware ATM Jackpotting: Tren de Aragua’s US Crime Wave, 2025
In December 2025, the U.S. Department of Justice charged 54 individuals associated with the Tren de Aragua criminal gang in a far-reaching ATM jackpotting operation across the United States. By deploying Ploutus malware onto automated teller machines, the group manipulated hardware to force cash withdrawals—ultimately stealing millions of dollars. The multi-state scheme involved coordinated physical access to ATMs, installation of malicious software, and cash-out teams, highlighting significant vulnerabilities in banking infrastructure and ATM security controls. This incident underscores an escalating wave of financially motivated attacks leveraging sophisticated malware and organized criminal networks. With jackpotting attacks resurging globally and law enforcement intensifying their response, organizations must prioritize layered defenses, real-time anomaly detection, and compliance with evolving regulatory requirements.
8 months ago
Kill Chain
E-Note Crypto Exchange Seized: $70M Ransomware Laundering Operation Disrupted
In December 2025, U.S. law enforcement agencies, in collaboration with Finnish and German authorities, seized the E-Note cryptocurrency exchange after investigating its role in facilitating ransomware-related money laundering. The FBI identified that over $70 million in proceeds from ransomware attacks and account takeover operations were funneled through E-Note since 2017, relying on a broad, international money mule network. The operation involved confiscating E-Note’s domains, mobile applications, servers, and transaction databases, severely disrupting a key enabling service for cybercriminals and potentially exposing a wide array of threat actors utilizing the platform. The alleged operator, Mykhalio Petrovich Chudnovets, has been indicted for money laundering and faces significant penalties. The takedown of E-Note highlights growing law enforcement action against illicit cryptocurrency infrastructure used by ransomware operators and cybercriminal ecosystems. The incident exemplifies an intensifying focus on disrupting financial channels that allow attackers to monetize stolen data and ransom payments, signaling increasing risk for enablers and users of such services.
8 months ago
Kill Chain
North Korea’s $2 Billion Crypto Heist: 2025’s Largest Nation-State Cyber Attack
In 2025, threat actors closely tied to North Korea orchestrated a record-breaking $2.02 billion in cryptocurrency thefts, representing over half of the global digital asset losses for the year. These attackers leveraged sophisticated intrusion techniques, advanced persistent threat (APT) operations, and exploited vulnerabilities in decentralized finance (DeFi) platforms and exchanges from January through early December. High-value thefts were often facilitated by exploiting weak internal controls, compromised credentials, and security gaps in cross-chain bridges, resulting in severe financial losses for both exchanges and their clients. This incident marks a significant escalation in nation-state cybercrime and highlights evolving attacker sophistication in targeting cryptocurrency infrastructure. It underscores escalating regulatory scrutiny and the necessity for organizations to bolster east-west traffic controls, threat detection, and zero trust architectures in response to persistent, financially-motivated adversaries.
8 months ago
Kill Chain
Cellik RAT’s Google Play Store Infiltration Exposes Mobile Security Gaps
In June 2024, cybersecurity researchers uncovered that the Cellik Android Remote Access Trojan (RAT) was being distributed through malicious applications on the official Google Play Store. The Cellik RAT allows attackers to remotely control infected Android devices, harvest sensitive credentials, and exfiltrate private data without the user’s knowledge. Threat actors used advanced evasion tactics, including app generation within Play Store guidelines and encrypted communications, to bypass traditional defenses. The incident highlights weaknesses in mobile app review processes and demonstrates the continued use of popular app stores as distribution vectors for sophisticated malware campaigns. This breach is especially notable as attackers continue to exploit trusted platforms like the Google Play Store, elevating risk for both individuals and enterprises. The emergence of Cellik marks an uptick in mobile RAT sophistication and underscores the urgent need for stronger app vetting and threat detection on mainstream digital ecosystems.
8 months ago
Kill Chain
DOJ Takes Down E-Note: Ransomware Laundering Hub Disrupted in 2024 Crackdown
In early 2024, the US Department of Justice, in partnership with international law enforcement, dismantled the E-Note cryptocurrency exchange—a major online infrastructure used for laundering illicit proceeds from ransomware and cybercrime. Authorities indicted Mykhalio Petrovich Chudnovets, a Russian national alleged to have operated E-Note since 2010, with facilitating the transfer of over $70 million in stolen or extorted funds from attacks targeting sectors like healthcare and critical infrastructure. Federal and state agencies seized E-Note servers, websites, and mobile apps, obtaining customer and transaction data to further map criminal networks. This takedown highlights cybercriminals’ growing use of specialized laundering platforms to enable ransomware and account takeover monetization at scale. As regulatory scrutiny intensifies and attacker infrastructure becomes more modular and resilient, law enforcement action against these enablers is an increasing priority.
8 months ago
Kill Chain
Cellik Android Malware: The New Frontier for Trojanized Google Play Apps
In December 2025, cybersecurity researchers identified a new Android malware-as-a-service (MaaS) dubbed Cellik that enables cybercriminals to create malicious variants of popular Google Play Store apps. Distributed via underground forums, Cellik’s service allows threat actors to select legitimate apps, inject sophisticated malware, and maintain original app functionality, thereby bypassing typical user suspicion and potentially evading Google Play Protect. Cellik's features include real-time screen streaming, notification interception, filesystem browsing, data exfiltration, device wiping, and encrypted command-and-control communications. Attackers can also overlay fake login screens, inject malicious payloads into trusted apps, and exploit a hidden browser to steal credentials using stored cookies from infected devices. The emergence of Cellik signals an evolution in Android threat tooling, where MaaS kits empower less skilled actors to launch advanced attacks. This development heightens risks for organizations subject to mobile threats as attackers embrace more modular and evasive tactics, underlining the urgent need for advanced mobile security controls and proactive user education.
8 months ago
Kill Chain
Turkey Hit by Advancing Android Banking Trojan: Inside the Frogblight Campaign
In August 2025, researchers identified a sophisticated Android banking Trojan dubbed "Frogblight" targeting users in Turkey. Distributed primarily through smishing campaigns and phishing sites masquerading as official government portals, Frogblight lured victims by posing as legitimate court case or Chrome browser apps. Once installed, it harvested banking credentials, SMS, contact lists, call logs, and device data, while providing remote device control and persistence mechanisms for operators. The malware communicated via REST API and later WebSockets to exfiltrate stolen data to attacker-controlled C2 servers and was frequently updated with new spyware features, indicating ongoing development and potential adoption as Malware-as-a-Service (MaaS). Frogblight exemplifies the rapid evolution and increasing capabilities of mobile banking malware. The campaign underscores the rising threat to mobile users—particularly in markets where banks and government digital services are trusted attack vectors—and reflects a broader trend toward commoditized MaaS offerings and advanced evasion techniques. Effective mobile security controls and user awareness remain critical as adversaries refine their payloads.
8 months ago
Kill Chain
Parked Domains Weaponized: Inside the 2025 Typosquatting Malvertising Surge
In late 2025, security researchers uncovered that over 90% of parked domains—unused, expired, or misspelled web addresses—were actively redirecting visitors to malicious destinations, including scams, malware, and deceptive subscription offers. Utilizing techniques like device fingerprinting, IP geolocation, and chained redirects, threat actors profited by manipulating the domain parking ecosystem, turning innocuous navigation mistakes into vectors for malware delivery and fraud. The campaign targeted high-profile brands and government offices, often bypassing detection by profiling user access (e.g., residential IPs or VPN use), with some domains weaponized for business email compromise. This incident highlights an alarming shift: parked and typo domains are now a primary malvertising risk, not a minor threat. As domain registration and ad platform policies evolve, attackers rapidly adapt, exploiting weaknesses in digital trust and endpoint security. Organizations must broaden threat detection and policy enforcement to address direct navigation attacks and affiliate-driven malvertising.
8 months ago
Kill Chain
700Credit 2024 Breach: 5.8 Million Dealership Customers' Data Exposed
In early 2024, 700Credit, a US-based fintech firm specializing in credit and compliance solutions for auto dealerships, disclosed a major data breach affecting over 5.8 million individuals. The breach was traced to a vulnerability in a third-party web application platform, resulting in unauthorized access to sensitive customer data submitted to vehicle dealerships across North America. Exposed data included names, addresses, Social Security Numbers, dates of birth, and driver’s license numbers. The breach forced 700Credit to rapidly contain the issue, engage forensic experts, and notify customers, while drawing regulatory scrutiny due to the significant privacy impact. This incident is especially important as it highlights the persistent risks presented by web application vulnerabilities and supply chain exposure across critical business platforms. Increased attacker focus on third-party dependencies and data-rich payment ecosystems continues to drive urgency around zero trust architectures and more proactive monitoring and response.
8 months ago
Kill Chain
SantaStealer: The 2024 Memory-Based Infostealer Malware Targeting Credentials and Crypto Wallets
In early 2024, a new information-stealing malware known as SantaStealer emerged on cybercriminal Telegram channels and hacker forums, operating as a malware-as-a-service (MaaS). Designed to run primarily in memory, SantaStealer avoids traditional file-based detection and targets sensitive data in browsers, cryptocurrency wallets, and installed application credentials. Attackers typically distribute the malware through phishing campaigns and malicious attachments. Once executed, SantaStealer exfiltrates stolen data to command-and-control servers, enabling threat actors to harvest victims' digital assets and credentials for further exploitation or sale on underground markets. The incident underlines a growing trend of evasive, memory-resident stealer malware leveraging MaaS models. Cybercriminals are accelerating adoption of these techniques, raising the stakes for organizations and individuals who store credentials and assets on personal and enterprise endpoints.
8 months ago
Kill Chain
Phantom Stealer Phishing: 2025 Attack Hits Russian Finance via ISO Emails
In late 2025, an active phishing campaign dubbed "Operation MoneyMount-ISO" began targeting the Russian financial sector and related industries, with threat actors distributing phishing emails containing malicious ISO disk image attachments. Once opened, these ISO files delivered the Phantom Stealer malware, enabling attackers to exfiltrate sensitive data from finance, accounting, procurement, legal, and payroll departments. The malware operated covertly, seeking credentials and financial information, leading to notable data exposure risks and potential regulatory disruptions for victim organizations. This campaign highlights the increasing sophistication of phishing operations leveraging disk image formats for initial access and the persistent targeting of high-value sectors with advanced infostealer malware. Financial and critical infrastructure organizations face heightened pressure to improve detection and segmentation as threat actors continually refine their social engineering tactics.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports